CVE-2025-10986 Overview
CVE-2025-10986 is a path traversal vulnerability [CWE-22] in the admin panel of Ivanti Endpoint Manager Mobile (EPMM). The flaw allows a remote authenticated attacker with administrator privileges to write files to unintended locations on disk. Ivanti disclosed the issue in its October 2025 EPMM security advisory and released fixes in versions 12.6.0.2, 12.5.0.4, and 12.4.0.4. Exploitation requires valid administrative credentials, which limits the attack population but still enables arbitrary file writes that can compromise system integrity.
Critical Impact
An authenticated administrator can write arbitrary files to unintended filesystem locations on the EPMM server, enabling tampering with server-side components and potential impact to availability.
Affected Products
- Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.6.0.2
- Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.5.0.4
- Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.4.0.4
Discovery Timeline
- 2025-10-14 - CVE-2025-10986 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10986
Vulnerability Analysis
The vulnerability resides in the EPMM administrative panel, which fails to properly validate or sanitize file path inputs before performing write operations. An authenticated administrator can supply crafted path components such as ../ sequences to escape the intended write directory. The result is a controlled file write to locations outside the expected boundary. Because the attacker must already hold admin privileges, exploitation depends on credential compromise, privilege abuse, or a chained attack that first obtains admin access. Successful exploitation can undermine the integrity of EPMM server files and may degrade availability of the mobile device management service.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The admin panel accepts file path or filename parameters and passes them to a write routine without canonicalizing the resulting path or verifying it remains inside the intended base directory. Path traversal sequences are therefore honored by the underlying filesystem operation.
Attack Vector
The attack vector is network-based against the EPMM administrative interface. An attacker authenticates with admin credentials and issues a request to an admin panel function that accepts a filename or path. By embedding traversal sequences in that parameter, the attacker redirects the write to an arbitrary location the EPMM service account can access.
No public proof-of-concept exploit is available at time of writing. See the Ivanti Security Advisory for EPMM 10.2025 for vendor technical details.
Detection Methods for CVE-2025-10986
Indicators of Compromise
- Unexpected files written to EPMM server directories outside the standard upload or configuration paths.
- Administrative panel access from unusual source IP addresses, off-hours sessions, or geographies inconsistent with normal admin behavior.
- Modifications to EPMM binaries, scripts, or configuration files not tied to a documented change ticket.
Detection Strategies
- Review EPMM administrative audit logs for requests containing ../, encoded traversal sequences (%2e%2e%2f), or unusual filename parameters.
- Correlate admin login events with subsequent file write activity on the EPMM host to identify anomalous sequences.
- Baseline the EPMM filesystem and alert on new or modified files outside directories expected to change during normal operation.
Monitoring Recommendations
- Forward EPMM application and web server logs to a centralized SIEM for retention and correlation.
- Enable file integrity monitoring on EPMM server directories, especially web root, configuration, and binary paths.
- Monitor for privilege changes and creation of new administrator accounts within EPMM.
How to Mitigate CVE-2025-10986
Immediate Actions Required
- Upgrade EPMM to version 12.6.0.2, 12.5.0.4, or 12.4.0.4 (or later) as documented in the Ivanti advisory.
- Rotate credentials for all EPMM administrator accounts and enforce multi-factor authentication where supported.
- Review recent admin activity for signs of abuse prior to patching.
Patch Information
Ivanti has released fixed builds in the 12.6.0.2, 12.5.0.4, and 12.4.0.4 release lines. Refer to the Ivanti Security Advisory for EPMM 10.2025 for the complete list of addressed CVEs and upgrade guidance.
Workarounds
- Restrict network access to the EPMM administrative panel using firewall rules or VPN so only trusted administrative subnets can reach it.
- Limit the number of accounts holding EPMM administrator privileges and audit their use regularly.
- Enforce strong authentication and session controls for administrators until patches are applied.
# Example: restrict admin panel access to a trusted management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
