CVE-2025-22466 is a high severity (CVSS 8.2) reflected cross-site scripting flaw in Ivanti Endpoint Manager. A remote unauthenticated attacker may obtain admin privileges if a user interacts with a crafted link. Versions before 2024 SU1 and before 2022 SU7 are affected, so update to those releases or later.
What's affected
The NVD record says Ivanti Endpoint Manager before version 2024 SU1, or before version 2022 SU7, is affected. That gives two supported release lines with a fixed update in each: 2024 SU1 and 2022 SU7.
The advisory page on the Ivanti forum is protected by a browser check and did not load for this review, so the statements here come from the NVD record. Read Ivanti's April 2025 advisory for EPM 2024 and EPM 2022 SU6 to confirm the fix and any other issues patched in the same update. The vector is AV:N/AC:L/PR:N/UI:R/S:C, meaning a network attack with no account, one required user action, and a changed scope.
How to check if you're exposed
In the Endpoint Manager console, open the About dialog to see the version and service update level. Compare it against 2024 SU1 and 2022 SU7.
Also note who can reach the console and from where. Because the attack needs a user to follow a crafted link, the people most at risk are administrators and help desk staff who use the web console while logged in.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Identify whether you run the 2024 or the 2022 line and your current service update.
- Download and apply 2024 SU1 or 2022 SU7 or later from Ivanti.
- Read the full Ivanti advisory for other fixes shipped in the same update.
- Remind administrators not to open unexpected links to the console while signed in.
- Limit console access to management networks.
Why it matters
CWE-79 covers cross-site scripting. In a reflected case, input from a request is echoed back in a page without being neutralized, so a link built by an attacker runs script in the victim's browser. If the victim is an administrator, that script acts with the administrator's rights, which is how a browser bug turns into a privilege problem. The vector's changed scope reflects that.
Endpoint management consoles control many machines, so an admin session is worth a lot. The NVD record does not mark this CVE as exploited, and the KEV flag is false. Patch on a normal fast track and restrict who can reach the console.
Quick check
Which versions are fixed?
The record says versions before 2024 SU1 and before 2022 SU7 are affected, so those updates or later fix the issue. Confirm in the Ivanti advisory.
Does it need user interaction?
Yes. The vector sets UI:R, so someone must follow a crafted link or similar action.
Sources
Last reviewed: 19 October 2026.
