Ivanti warns of critical Endpoint Manager code execution flaw

Ivanti disclosed critical and high-severity vulnerabilities in its Endpoint Manager product (notably CVE-2025-10573) that allow unauthenticated attackers to execute arbitrary JavaScript via stored XSS (requiring user interaction), potentially compromising administrator sessions; Ivanti released patches and Shadowserver reports hundreds of internet-exposed EPM instances, but there is no confirmed evidence of exploitation so far.