What the vulnerability does
01Description
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.
CVSS base score
7.1/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Key dates
02Disclosure timeline
December 9, 2025
CVE published
February 26, 2026
Record updated
External resources
