CVE-2025-11622 Overview
CVE-2025-11622 is an insecure deserialization vulnerability in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU4. The flaw allows a local authenticated attacker to escalate privileges on affected systems by supplying crafted serialized data to a vulnerable component. Ivanti published a security advisory in October 2025 confirming the issue and providing fixed builds. The weakness is tracked under CWE-502: Deserialization of Untrusted Data.
Critical Impact
A local authenticated attacker can escalate privileges on Ivanti Endpoint Manager hosts running vulnerable builds, gaining high impact on confidentiality, integrity, and availability.
Affected Products
- Ivanti Endpoint Manager 2024 (base release)
- Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
- Ivanti Endpoint Manager versions prior to 2024 SU4
Discovery Timeline
- 2025-10-13 - CVE-2025-11622 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11622
Vulnerability Analysis
The vulnerability stems from unsafe deserialization of untrusted data in Ivanti Endpoint Manager. When the affected component processes serialized objects supplied by a local authenticated user, it reconstructs them without adequate type validation or allow-listing. An attacker with a valid local session can submit crafted serialized payloads that trigger gadget chains during deserialization, ultimately executing code in the context of a higher-privileged process.
Because Endpoint Manager runs with elevated service privileges to manage endpoints, successful exploitation leads to privilege escalation on the EPM host. The attack requires local access and low privileges, but no user interaction. Impact on confidentiality, integrity, and availability is high, consistent with code execution under a privileged service account.
Root Cause
The root cause is improper handling of serialized objects [CWE-502]. The affected code path deserializes attacker-controlled input without enforcing strict type constraints, safe converters, or integrity checks. This design flaw allows malicious object graphs to invoke unintended methods during deserialization.
Attack Vector
Exploitation requires local access to an EPM system and an authenticated session with low privileges. The attacker delivers a crafted serialized payload to the vulnerable interface, triggering deserialization within a privileged process. No user interaction is required, and the scope remains unchanged. Ivanti has not reported in-the-wild exploitation, and no public proof-of-concept is available at time of writing.
See the Ivanti Security Advisory for vendor technical details.
Detection Methods for CVE-2025-11622
Indicators of Compromise
- Unexpected child processes spawned by Ivanti Endpoint Manager service accounts on EPM servers.
- Anomalous local privilege transitions where a low-privileged user's process is followed by activity under a SYSTEM or service context.
- Creation of new local administrator accounts, scheduled tasks, or services shortly after EPM service activity.
Detection Strategies
- Monitor EPM host process trees for deserialization-related exceptions and unusual .NET or Java stack traces in application logs.
- Alert on writes to sensitive paths (service binaries, startup locations, registry Run keys) originating from EPM service processes.
- Correlate local logon events with subsequent privileged process creation on EPM servers to identify escalation patterns.
Monitoring Recommendations
- Enable verbose logging on Ivanti Endpoint Manager components and forward logs to a centralized SIEM for retention and correlation.
- Track EPM software inventory to ensure all instances report a build at or above 2024 SU4.
- Baseline expected EPM service behavior and alert on deviations such as new outbound connections or unexpected module loads.
How to Mitigate CVE-2025-11622
Immediate Actions Required
- Upgrade Ivanti Endpoint Manager to version 2024 SU4 or later on all core servers and consoles.
- Restrict local interactive and remote logon rights on EPM servers to a minimal set of administrators.
- Audit local accounts on EPM hosts and remove or disable any that are unused or over-privileged.
Patch Information
Ivanti addressed CVE-2025-11622 in Endpoint Manager 2024 SU4. Administrators should review the Ivanti Security Advisory - Ivanti Endpoint Manager (EPM) October 2025 for the full list of fixed builds and upgrade guidance. Apply the update following Ivanti's documented change procedures, including backup of the EPM database prior to upgrade.
Workarounds
- No vendor-supplied workaround exists; upgrading to 2024 SU4 is the required remediation.
- Reduce exposure by isolating EPM servers on a management network segment with strict access controls.
- Enforce multi-factor authentication and just-in-time administration for accounts able to log on locally to EPM hosts.
# Verify installed Ivanti Endpoint Manager version on Windows
reg query "HKLM\SOFTWARE\LANDesk\ManagementSuite\Setup" /v CoreVersion
# Confirm the reported version is 2024 SU4 or later before returning the host to production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
