Actively exploited in the wild
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
Ivanti - Endpoint Manager Mobile (EPMM) · Listed in the CISA KEV since 2025-05-19. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-4427
MediumCVSS 5.3KEVSummary
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
Risk Assessment
An API authentication bypass can enable unauthorized access to mobile device management data and functions, posing a serious risk to organizational security.
Recommendation
Upgrade Ivanti Endpoint Manager Mobile to a version later than 12.5.0.0 and restrict API access to trusted networks.
Other vulnerabilities in Ivanti Endpoint Manager Mobile
See all- CVE-2026-1281CriticalActively exploited
Code injection vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- CVE-2025-4428HighActively exploited
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
- CVE-2026-18851High
Missing authorization in Ivanti Endpoint Manager Mobile before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
Original NVD description (English source)
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.