CVE-2025-13661: Ivanti Endpoint Manager Path Traversal

CVE-2025-13661 Overview

CVE-2025-13661 is a path traversal vulnerability [CWE-22] in Ivanti Endpoint Manager (EPM) affecting versions prior to 2024 SU4 SR1. The flaw allows a remote authenticated attacker to write arbitrary files outside of the intended directory. Successful exploitation requires user interaction. Ivanti disclosed the issue in its December 2025 security advisory and shipped a fix in EPM 2024 SU4 SR1.

Critical Impact
An authenticated attacker can write files to arbitrary locations on the EPM server, enabling code execution, configuration tampering, or persistence on a system that manages enterprise endpoints.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, SU3 Security Release 1
Ivanti Endpoint Manager 2024 SU4 (fixed in 2024 SU4 SR1)

Discovery Timeline

2025-12-09 - CVE-2025-13661 published to the National Vulnerability Database
2025-12-09 - Ivanti released the December 2025 EPM security advisory and patch
2025-12-11 - Last updated in the NVD database

Technical Details for CVE-2025-13661

Vulnerability Analysis

The vulnerability is a classic path traversal weakness in Ivanti Endpoint Manager. EPM accepts a file path or filename parameter from an authenticated user but fails to canonicalize and validate that input against the intended write directory. An attacker who supplies traversal sequences such as ..\ or absolute path components can redirect file write operations to arbitrary locations on the EPM server.

The attack vector is network-based and requires low privileges plus user interaction, per the published CVSS metrics. Because EPM is a systems management product running with elevated service privileges, files written by the vulnerable code path inherit those privileges. Attackers can drop scheduled task definitions, replace executables loaded by the EPM service, or stage web shells in directories served by the management console.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected EPM component concatenates user-supplied input into a destination path without normalizing traversal sequences or enforcing that the resolved path remains under the intended base directory. Ivanti's advisory references this class of flaw and ships hardened input handling in 2024 SU4 SR1.

Attack Vector

An authenticated user with access to the vulnerable EPM workflow triggers the file write operation while inducing a second user to interact with the malicious request, satisfying the UI:R requirement. The attacker controls the destination path via the traversal payload and the file contents via the upload parameter. Because EPM is centrally deployed, a single successful write can be leveraged to compromise managed agents across the environment. No public proof-of-concept exploit was available at the time of disclosure.

For full technical details, consult the Ivanti Security Advisory December 2025.

Detection Methods for CVE-2025-13661

Indicators of Compromise

HTTP requests to EPM endpoints containing path traversal sequences such as ..\, ..%2f, or absolute paths in filename parameters.
Unexpected files written under EPM service directories, C:\Windows\System32\, C:\ProgramData\, or web-accessible paths on the EPM server.
New or modified files in EPM directories with timestamps that do not align with vendor patch or deployment activity.
EPM service processes spawning unexpected child processes such as cmd.exe, powershell.exe, or script interpreters.

Detection Strategies

Inspect EPM IIS and application logs for POST or PUT requests carrying encoded traversal patterns in path or filename fields.
Alert on file creation events in sensitive directories where the writing process is an Ivanti EPM service account.
Correlate authenticated EPM sessions with abnormal file write volumes or writes outside designated upload directories.

Monitoring Recommendations

Forward EPM server EDR telemetry, IIS logs, and Windows file system audit events to a central analytics platform for retroactive hunting.
Track integrity of EPM binaries, configuration files, and scheduled task definitions using file integrity monitoring.
Monitor outbound connections from the EPM server for command-and-control activity following any suspicious file write.

How to Mitigate CVE-2025-13661

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU4 SR1 or later as published in the December 2025 advisory.
Inventory all EPM servers and confirm patch status; prioritize internet-exposed or partner-facing instances first.
Audit EPM administrative accounts and revoke unused or stale credentials that satisfy the authenticated precondition.
Review EPM server file systems for unexpected files created prior to patching to rule out exploitation.

Patch Information

Ivanti fixed CVE-2025-13661 in Ivanti Endpoint Manager 2024 SU4 SR1. Download and deployment instructions are available in the Ivanti Security Advisory December 2025. Apply the patch through the standard EPM update channel and validate service health after deployment.

Workarounds

Restrict network access to the EPM console and API endpoints to trusted management networks using firewall rules.
Enforce least privilege on EPM accounts so that only required administrators can invoke file upload workflows.
Require multi-factor authentication for all EPM administrative access to limit credential reuse.
Increase logging verbosity on the EPM server and forward logs externally to preserve evidence if exploitation is attempted before patching.

bash

# Example: restrict EPM management interface to a trusted subnet on Windows
New-NetFirewallRule -DisplayName "EPM-Admin-Allowlist" \
    -Direction Inbound \
    -Protocol TCP \
    -LocalPort 443 \
    -RemoteAddress 10.10.20.0/24 \
    -Action Allow

New-NetFirewallRule -DisplayName "EPM-Admin-BlockAll" \
    -Direction Inbound \
    -Protocol TCP \
    -LocalPort 443 \
    -Action Block