CVE-2025-13662: High severity Ivanti Endpoint Manager vulnerability
Published Dec 9, 2025
·Updated
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.
Affected Software
8 affected components
Ivanti Endpoint Manager<2024 SU4 SR1
Ivanti Endpoint Manager<2024
Ivanti Endpoint Manager=2024
Ivanti Endpoint Manager=2024-su1
Ivanti Endpoint Manager=2024-su2
Ivanti Endpoint Manager=2024-su3
Ivanti Endpoint Manager=2024-su3_security_release_1
Ivanti Endpoint Manager=2024-su4
Event History
Dec 9, 2025
CVE Published
via MITRE·04:05 PM
Data Sourced
via MITRE·04:05 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeaknessAffected Software
News Published
via BleepingComputer·05:10 PM
News Published
via BleepingComputer·05:12 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-13662?
CVE-2025-13662 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2025-13662?
To fix CVE-2025-13662, update your Ivanti Endpoint Manager to version 2024 SU4 SR1 or later.
3
What are the potential impacts of exploiting CVE-2025-13662?
Exploiting CVE-2025-13662 could allow an attacker to execute arbitrary code on the affected system.
4
Is user interaction required to exploit CVE-2025-13662?
Yes, user interaction is required to exploit CVE-2025-13662.
5
Which versions of Ivanti Endpoint Manager are affected by CVE-2025-13662?
Ivanti Endpoint Manager versions prior to 2024 SU4 SR1 are affected by CVE-2025-13662.