Multiple Vulnerabilities in Ivanti Endpoint Manager Could Allow for Remote Code Execution

Multiple vulnerabilities in Ivanti Endpoint Manager (versions before 2024 SU1 and before 2022 SU7), including reflected XSS (CVE-2025-22465, CVE-2025-22466), DLL hijacking (CVE-2025-22458), and SQL injection (CVE-2025-22461), could allow remote code execution, privilege escalation to SYSTEM, denial-of-service, and limited interception of traffic; successful exploitation could let an attacker install programs and view, change, or delete data.