CVE-2025-10573

Medium · 6.1

CVSS

6.1

EPSS

33.5%

Published

Dec 9, 2025

CISA due date

—

The record

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Affected packages

Ecosystem	Package	Introduced	Fixed