CVE-2025-13659
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-11

Assigner: ivanti

Description
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-09
Last Modified
2025-12-11
Generated
2026-06-16
AI Q&A
2025-12-09
EPSS Evaluated
2026-06-14
NVD
CVE-2025-13659
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
ivanti endpoint_manager *
ivanti endpoint_manager 2024
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-913 The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 involves improper control of dynamically managed code resources. It allows a remote, unauthenticated attacker to write arbitrary files on the server, which could potentially lead to remote code execution. User interaction is required for exploitation.

Impact Analysis

The vulnerability can allow an attacker to write arbitrary files on the server remotely without authentication, potentially leading to remote code execution. This means an attacker could take control of the affected system, compromise data integrity, availability, and confidentiality.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart