CVE-2025-10573: XSS
Published Dec 9, 2025
·Updated
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
Affected Software
8 affected components
Ivanti Endpoint Manager<2024 SU4 SR1
Ivanti Endpoint Manager<2024
Ivanti Endpoint Manager=2024
Ivanti Endpoint Manager=2024-su1
Ivanti Endpoint Manager=2024-su2
Ivanti Endpoint Manager=2024-su3
Ivanti Endpoint Manager=2024-su3_security_release_1
Ivanti Endpoint Manager=2024-su4
Event History
Dec 9, 2025
CVE Published
via MITRE·03:55 PM
Data Sourced
via MITRE·03:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeaknessAffected Software
News Published
via BleepingComputer·05:10 PM
News Published
via BleepingComputer·05:12 PM
News Published
via The Register·11:42 PM
News Published
via The Register·11:44 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-10573?
CVE-2025-10573 has been rated as a high severity vulnerability due to its potential to allow arbitrary JavaScript execution in an administrator session.
2
How do I fix CVE-2025-10573?
To fix CVE-2025-10573, upgrade your Ivanti Endpoint Manager to version 2024 SU4 SR1 or later.
3
What type of vulnerability is CVE-2025-10573?
CVE-2025-10573 is a stored cross-site scripting (XSS) vulnerability.
4
Who can exploit CVE-2025-10573?
CVE-2025-10573 can be exploited by a remote unauthenticated attacker with user interaction required.
5
What software versions are affected by CVE-2025-10573?
CVE-2025-10573 affects Ivanti Endpoint Manager versions before 2024 SU4 SR1.