Ivanti’s Patch Delays: 13 Unpatched Vulnerabilities Lurking in Endpoint Manager

Hot Take:

Buckle up, folks! Ivanti’s Endpoint Manager has more holes than a Swiss cheese, and Trend Micro’s ZDI is here to spill the beans. With a mix of local privilege escalation and remote code execution flaws, it’s like a cybersecurity version of a reality TV drama. Keep your popcorn handy, because this saga ain’t over yet!

Key Points:

• Trend Micro’s ZDI has published advisories on 13 unpatched vulnerabilities in Ivanti Endpoint Manager.
• One flaw allows local privilege escalation, while the remaining 12 can lead to remote code execution.
• The vulnerabilities lack CVE identifiers but have high-severity CVSS scores, with the highest at 8.8.
• Ivanti has been aware of these issues since late 2024 but requested patch extensions until March 2026.
• ZDI’s policy dictates a 120-day window for patching, after which advisories are published if unresolved.

Vulnerability Parade: The Unpatched Show

In the cybersecurity circus, Trend Micro’s Zero Day Initiative (ZDI) is the ringmaster, and Ivanti Endpoint Manager is the unwitting clown. With 13 unpatched vulnerabilities taking center stage, it’s a performance you won’t want to miss. ZDI’s latest advisories describe how these flaws allow local attackers to elevate their privileges and remote code execution, creating a potential security nightmare. While these aren’t technically zero-days, ZDI’s insistence on labeling them as ‘0day’ adds a sprinkle of drama to the mix.

No CVE? No Problem!

Who needs a CVE identifier when you’ve got a CVSS score? Ivanti’s vulnerabilities may not have the official badge of honor, but they’re making quite the impression with scores that scream “high-severity.” With one vulnerability scoring a solid 8.8 and others not far behind, it’s clear that these aren’t just your run-of-the-mill bugs. But fear not! ZDI is here to break down the vulnerabilities in layman’s terms, sans the nitty-gritty technical jargon. Just know that if it involves user-supplied input and improper validation, it’s probably not good news.

Ivanti’s Patchy Patchwork

Ivanti’s journey to patching these vulnerabilities is like a road trip with unexpected detours and plenty of pit stops. They first learned about the local privilege escalation flaw in November 2024, yet here we are, still waiting for the fix. The company initially promised patches for the remote code execution vulnerabilities by September, only to ask for an extension until March 2026. It’s like waiting for your favorite show’s season finale, except less exciting and more nerve-wracking.

120 Days of Summer (Vulnerability)

ZDI, being the responsible adult in the room, allows vendors a 120-day grace period to address reported vulnerabilities. If the vendor misses the deadline and can’t provide a reasonable excuse, ZDI spills the beans with a limited advisory. In Ivanti’s case, the clock is ticking louder than a countdown to New Year’s Eve. While ZDI advises restricting interaction with the product as a temporary measure, we all know that’s like putting a band-aid on a broken leg. Hopefully, Ivanti’s got a plan up its sleeve before the buzzer sounds.

Ivanti, Speak Now or Forever Hold Your Peace

The silence from Ivanti is deafening, with no advisory or public statement to address the vulnerabilities. SecurityWeek reached out to Ivanti for comment, but it seems like they’re playing a game of hide-and-seek for now. As we all wait with bated breath for a response, one thing’s for sure: the cybersecurity community is on high alert, ready to pounce on any updates. Until then, keep your networks secure and your fingers crossed for a swift resolution.