Multiple Vulnerabilities in Ivanti Products Could Allow for Remote Code Execution

Multiple vulnerabilities have been disclosed in Ivanti products, including a critical unauthenticated path traversal in Ivanti Endpoint Manager enabling remote code execution (CVE-2025-9713), plus numerous other issues—SQL injection, OS command injection, insecure deserialization, missing auth, and MFA bypasses—across Ivanti Neurons, EPMM, and Endpoint Manager; these could allow attackers to execute code, escalate privileges, and access or modify data depending on system privileges. The report enumerates affected versions and CVEs but does not indicate active exploitation.