CVE-2025-22458

HIGH

Ivanti Endpoint Manager < 2022 - Uncontrolled Search Path

Title source: rule

DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System.

CVSS v3 7.8

EPSS 0.0015

EPSS Percentile 35.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

CWE

CWE-427

Status published

Products (3)

ivanti/endpoint_manager 2022 (7 CPE variants)

ivanti/endpoint_manager 2024

ivanti/endpoint_manager < 2022

Published Apr 08, 2025

Tracked Since Feb 18, 2026