Multiple Vulnerabilities in Ivanti Products Could Allow for Remote Code Execution

Multiple critical and lower-severity vulnerabilities were disclosed in Ivanti products. The most severe allows remote unauthenticated remote code execution against Ivanti Endpoint Manager (CVE-2025-9712, CVE-2025-9872); additional flaws include missing authorization, CSRF, SSRF, reflected text injection and denial-of-service across Ivanti Connect Secure, Policy Secure, ZTA Gateway and Neurons for Secure Access in specified pre-patch versions (fixes noted as deployed 02-Aug-2025). Successful exploitation could permit attackers to execute code, install programs, and view, change, or delete data depending on system privileges.