CVE-2025-10985
High · 7.2CVSS
7.2
EPSS
20.4%
Published
Oct 14, 2025
CISA due date
—
The record
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|