Insecure Deserialization Vulnerability in Ivanti Endpoint Manager
CVE-2025-11622

7.8HIGH

Key Information:

Vendor

Ivanti
Status
Endpoint Manager
Vendor
CVE Published:
13 October 2025

What is CVE-2025-11622?

An insecure deserialization vulnerability in Ivanti Endpoint Manager enables a local authenticated attacker to exploit the system, potentially leading to privilege escalation. This weakness allows attackers to modify serialized data, which can then be deserialized without proper validation, granting unauthorized access or additional rights within the application.

Affected Version(s)

Endpoint Manager 2024 SU4

References

https://forums.ivanti.com/s/article/Security-Advisory-Iva...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.