CVE-2025-22458

HIGH

Ivanti Endpoint Manager < 2022 - Uncontrolled Search Path

Title source: rule

DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System.

CVSS v3 7.8

EPSS 0.0015

EPSS Percentile 35.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-427

Status published

ivanti/endpoint_manager < 2022

ivanti/endpoint_manager

Published Apr 08, 2025

Tracked Since Feb 18, 2026