CVE-2025-22459: Ivanti Endpoint Manager Info Disclosure

CVE-2025-22459 Overview

CVE-2025-22459 affects Ivanti Endpoint Manager (EPM) versions prior to 2024 SU1 and 2022 SU7. The vulnerability stems from improper certificate validation in the communication channel between EPM clients and servers. A remote unauthenticated attacker positioned on the network path can intercept a limited subset of client-server traffic. The weakness maps to [CWE-295] Improper Certificate Validation and [CWE-296] Improper Following of a Certificate's Chain of Trust. Ivanti disclosed the issue in the April 2025 security advisory covering EPM 2024 and EPM 2022 SU6.

Critical Impact
A network-adjacent attacker can perform a man-in-the-middle (MITM) attack against EPM client-server traffic, exposing limited confidential data and enabling tampering of intercepted communications.

Affected Products

Ivanti Endpoint Manager 2022 (including SU1 through SU6)
Ivanti Endpoint Manager 2024 (base release)
All EPM builds prior to 2024 SU1 or 2022 SU7

Discovery Timeline

2025-04-08 - CVE-2025-22459 published to NVD
2025-04-08 - Ivanti releases security advisory and patches for EPM 2024 SU1 and EPM 2022 SU7
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22459

Vulnerability Analysis

Ivanti Endpoint Manager coordinates configuration, patching, and software distribution between a central server and managed endpoints. Communication between EPM agents and the core server relies on TLS to protect configuration data, credentials, and policy directives. The vulnerable versions fail to fully validate the server certificate presented during the TLS handshake. An attacker capable of positioning on the network path can present a crafted or substitute certificate and complete the handshake without triggering a client-side error.

Root Cause

The root cause is incomplete certificate chain validation within the EPM client-server communication component. The client accepts certificates that do not properly chain to a trusted root or that fail specific validation checks tied to identity binding. This weakness aligns with both [CWE-295] and [CWE-296], indicating that trust decisions rely on insufficient checks rather than full chain-of-trust verification.

Attack Vector

Exploitation requires a network position between the EPM agent and server, such as an attacker on a shared network segment, a compromised network device, or an ARP or DNS spoofing scenario. The attack complexity is high because the adversary must intercept live traffic and coordinate the timing of the MITM. Successful interception exposes a limited portion of transiting data and permits tampering with that same subset. No user interaction or prior authentication is required. Because only limited traffic is affected, full session compromise is not guaranteed.

Detection Methods for CVE-2025-22459

Indicators of Compromise

Unexpected TLS certificate fingerprints presented by hosts identified as EPM core servers.
EPM agent connections terminating at IP addresses that do not match the documented EPM core server inventory.
ARP table anomalies or gratuitous ARP traffic on segments carrying EPM agent-to-server communication.

Detection Strategies

Inspect TLS handshakes for EPM traffic and alert on certificate issuer, subject, or fingerprint values that deviate from the approved EPM core certificate.
Correlate DNS responses for EPM core server hostnames against a known-good baseline to identify spoofed resolutions.
Monitor for downgraded cipher suites or unexpected certificate chain lengths in flows to EPM listener ports.

Monitoring Recommendations

Enable packet capture or network detection and response coverage on subnets hosting EPM agents and core servers.
Forward EPM server, network, and endpoint telemetry to a centralized analytics platform for cross-source correlation.
Baseline normal EPM communication patterns, including source subnets and connection cadence, to surface deviations quickly.

How to Mitigate CVE-2025-22459

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU1 or 2022 SU7 as documented in the Ivanti Security Advisory EPM April 2025.
Inventory all EPM core servers and agent versions to confirm patch coverage across the environment.
Rotate any credentials or secrets that may have transited EPM communication channels prior to patching.

Patch Information

Ivanti addressed CVE-2025-22459 in EPM 2024 SU1 and EPM 2022 SU7. Administrators should apply the service updates through the standard Ivanti patch channels and validate agent connectivity after deployment. Refer to the Ivanti Security Advisory EPM April 2025 for the full list of fixed CVEs and download links.

Workarounds

Restrict EPM agent-to-server traffic to dedicated, isolated management VLANs to reduce MITM exposure.
Enforce network segmentation and 802.1X or MACsec on segments carrying EPM management traffic.
Deploy static ARP entries or DHCP snooping on switches serving EPM infrastructure to limit spoofing opportunities.

bash

# Example: enforce a dedicated management VLAN ACL on a Cisco switch
# Only permit EPM agents in 10.20.0.0/16 to reach the EPM core at 10.30.5.10
ip access-list extended EPM-MGMT
  permit tcp 10.20.0.0 0.0.255.255 host 10.30.5.10 eq 443
  deny   ip any host 10.30.5.10 log
  permit ip any any
interface Vlan30
  ip access-group EPM-MGMT in