CVE-2025-10918: Ivanti Endpoint Manager Privilege Escalation

CVE-2025-10918 Overview

CVE-2025-10918 affects the Ivanti Endpoint Manager agent in versions prior to 2024 SU4. The vulnerability stems from insecure default permissions [CWE-276] that allow a local authenticated attacker to write arbitrary files anywhere on disk. Ivanti disclosed the issue in its November 2025 security advisory.

Successful exploitation compromises system integrity and availability. An attacker with local access can overwrite protected files, plant malicious binaries in system directories, and escalate privileges on the affected endpoint.

Critical Impact
A local authenticated attacker can write arbitrary files anywhere on disk, enabling privilege escalation, persistence, and tampering with system binaries on hosts running the Ivanti Endpoint Manager agent.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
All Ivanti Endpoint Manager releases before 2024 SU4

Discovery Timeline

2025-11-11 - CVE-2025-10918 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10918

Vulnerability Analysis

The Ivanti Endpoint Manager (EPM) agent ships with insecure default permissions on files or directories it uses at runtime. A local authenticated user inherits write access to resources that should be restricted to privileged accounts. The agent then operates on those attacker-controlled resources with higher privileges.

Because the EPM agent runs with elevated rights to manage endpoints, an attacker can leverage the weak permissions to write files to arbitrary locations on disk. This includes locations reserved for the operating system, service binaries, or scheduled task payloads. The result is a reliable local privilege escalation and integrity compromise primitive.

The attack requires local access and low privileges, but no user interaction. Impact on confidentiality is limited, while impact on integrity and availability is high because arbitrary file writes can destroy or replace critical data.

Root Cause

The root cause is misconfigured access control on agent files or working directories, classified under [CWE-276] Incorrect Default Permissions. Ivanti did not restrict write access to trusted service accounts during installation.

Attack Vector

A local authenticated attacker abuses the writable resource used by the EPM agent. By placing or modifying a file that the agent later consumes or executes under a privileged context, the attacker forces the write to occur in a location of their choosing. No verified proof-of-concept exploit is publicly available at the time of publication.

Detection Methods for CVE-2025-10918

Indicators of Compromise

Unexpected file writes to system directories such as C:\Windows\System32 or C:\Program Files originating from non-administrative user contexts.
New or modified files under the Ivanti EPM agent installation directory owned by standard user accounts.
Creation of DLLs, executables, or scheduled task XML files by processes spawned from the EPM agent working directory.

Detection Strategies

Audit NTFS access control lists (ACLs) on the Ivanti EPM agent directory and flag entries granting write access to Users, Authenticated Users, or Everyone.
Monitor for file creation events (Windows Event ID 4663) targeting protected paths where the process parent is the EPM agent.
Correlate local logon events with subsequent file writes to system directories to identify attempts to abuse the weak permissions.

Monitoring Recommendations

Enable file integrity monitoring on Ivanti EPM installation paths and Windows system directories.
Forward Sysmon Event ID 11 (FileCreate) and Event ID 15 (FileCreateStreamHash) to a centralized SIEM for review.
Baseline normal agent behavior and alert on deviations, especially writes performed while a non-service user is interactively logged on.

How to Mitigate CVE-2025-10918

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU4 or later on all managed servers and endpoints.
Inventory hosts running vulnerable EPM agent builds and prioritize systems with interactive local users.
Review and tighten NTFS permissions on the EPM agent directory to remove write access for non-administrative principals.

Patch Information

Ivanti addressed CVE-2025-10918 in Endpoint Manager 2024 SU4. Refer to the Ivanti Security Advisory EPM November 2025 for download links, hotfix guidance, and verification steps.

Workarounds

Restrict interactive logon rights on servers hosting the EPM agent to reduce the local attacker population.
Manually correct directory ACLs on the EPM agent path so only SYSTEM and Administrators retain write permissions until patching completes.
Enable application control policies to block execution of unsigned binaries dropped into agent-adjacent directories.

bash

# Example: audit and remediate NTFS permissions on the Ivanti EPM agent directory (Windows PowerShell)
Get-Acl 'C:\Program Files (x86)\LANDesk' | Format-List
icacls 'C:\Program Files (x86)\LANDesk' /remove:g 'Users' 'Authenticated Users'
icacls 'C:\Program Files (x86)\LANDesk' /inheritance:r
icacls 'C:\Program Files (x86)\LANDesk' /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F'