Critical Ivanti EPM Vulnerability Allows Admin Session Hijacking via Stored XSS

A critical stored cross-site scripting vulnerability in Ivanti Endpoint Manager (“EPM”) versions 2024 SU4 and below, that could enable attackers to hijack administrator sessions without authentication. The vulnerability, identified as CVE-2025-10573, has been assigned a CVSS score of 9.6 and patched on December 9, 2025, with the release of Ivanti EPM version 2024 SU4 SR1. […]

The post Critical Ivanti EPM Vulnerability Allows Admin Session Hijacking via Stored XSS appeared first on Cyber Security News.

This article has been indexed from Cyber Security News

Read the original article: