Actively exploited in the wild
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti - Endpoint Manager Mobile (EPMM) · Listed in the CISA KEV since 2025-05-19. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-4428
HighCVSS 7.2KEVSummary
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
Risk Assessment
An authenticated attacker can execute arbitrary code on the server, potentially leading to full compromise of the device management system.
Recommendation
Update Ivanti Endpoint Manager Mobile to a patched version or restrict API access to trusted users only.
Other vulnerabilities in Ivanti Endpoint Manager Mobile
See all- CVE-2026-1281CriticalActively exploited
Code injection vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- CVE-2026-18851High
Missing authorization in Ivanti Endpoint Manager Mobile before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
Original NVD description (English source)
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.