CVE-2025-10986: endpoint manager mobile before 12.4.0.4 (exclusive), from 12.5.0.0 (inclusive), before 12.5.0.4 (exclusive), from…

Affected technology

endpoint manager mobile · before 12.4.0.4 (exclusive)
ivanti

endpoint manager mobile · from 12.5.0.0 (inclusive), before 12.5.0.4 (exclusive)
ivanti

endpoint manager mobile · from 12.6.0.0 (inclusive), before 12.6.0.2 (exclusive)
ivanti

Endpoint Manager Mobile · Exact affected versions not specified by the source
Ivanti

Description’s affected range: before version 12.6.0.2, 12.5.0.4, and 12.4.0.4

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

A remote authenticated attacker with admin privileges can write data in unintended locations on disk. Source advisory’s CVSS 3.1 assessment (base score 4.7/10) rates confidentiality, integrity and availability impact as low. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality impact as none; integrity impact as high; availability impact as low.