Severe security flaws have been identified in Ivanti Endpoint Manager Mobile (EPMM), a popular mobile device management (MDM) platform, putting organizations at high risk of unauthorized remote code execution (RCE).
The flaws, identified as CVE-2025-4427 and CVE-2025-4428, are actively being exploited by cybercriminals, sparking urgent patching requests from both Ivanti and cybersecurity agencies.
Detailed Breakdown of the Vulnerabilities
As reported by WatchTowr, these vulnerabilities allow attackers to bypass authentication mechanisms and execute malicious code on the target systems when exploited together.
- CVE-2025-4427 (CVSS 5.3): This flaw enables unauthenticated attackers to access protected API endpoints, circumventing the need for valid credentials.
- CVE-2025-4428 (CVSS 7.2): A critical vulnerability that facilitates remote code execution by allowing attackers to inject Java Expression Language (EL) payloads into API requests, exploiting user-controlled input to execute arbitrary code.
These flaws affect all on-premises Ivanti EPMM versions up to and including 12.5.0.0. Patches have been made available for versions 11.12.0.5, 12.3.0.2, 12.4.0.2, and 12.5.0.1.
How the Vulnerabilities Work
The root cause of these vulnerabilities lies in the improper handling of parameters in the /api/v2/featureusage endpoint. A flawed validation of the format parameter allows attackers to inject malicious Java EL expressions.
When these malicious inputs are passed into error messages, the Spring Framework processes them, triggering remote code execution on the server. The authentication bypass (CVE-2025-4427) occurs due to a misconfiguration in security routing, enabling attackers to interact with vulnerable endpoints without authentication.
This “order of operations” vulnerability allows attackers to exploit the RCE flaw (CVE-2025-4428) even without authentication.
Exploitation and Risk
Both Ivanti and various cybersecurity bodies have confirmed that the vulnerabilities have been exploited in targeted attacks, with the possibility of wider attacks as proof-of-concept code becomes publicly available.
MDM solutions like Ivanti EPMM have extensive control over managed devices, meaning that if exploited, attackers could deploy malware or ransomware across a vast number of systems. The vulnerabilities trace back to the integration of two open-source libraries, which is not related to Ivanti’s proprietary code, highlighting the risks posed by third-party software dependencies in enterprise tools.
Successful exploitation could enable attackers to install malicious programs, steal sensitive data, or disrupt device management for entire organizations.
Ivanti has already released patches and urges customers to immediately upgrade to the latest versions. Organizations unable to upgrade should consult Ivanti’s advisory for mitigation steps and monitor systems closely for any signs of compromise.
Given the critical nature of these flaws and the public availability of exploit code, unpatched systems are vulnerable to immediate attacks.
Security agencies such as the NHS, ASD, and CERT-EU have emphasized the need for rapid action to prevent widespread exploitation.
The ongoing exploitation of these vulnerabilities highlights the continued risks posed by both open-source dependencies and security misconfigurations in enterprise software environments. Organizations using Ivanti EPMM must prioritize patching and assess their systems for exposure to minimize the risk of attack.
