The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two high-risk zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, are actively being exploited in the wild and present a serious threat to organizations utilizing Ivanti’s EPMM platform.
CVE-2025-4427 resides in the Ivanti EPMM API component, enabling attackers to bypass authentication controls by sending specially crafted API requests. This vulnerability is due to a flawed implementation of the Spring Framework library, resulting in unauthorized access to protected resources, and is classified under CWE-288 (Authentication Bypass).
CVE-2025-4428 allows authenticated attackers to execute arbitrary code remotely through crafted API requests. This vulnerability stems from insecure usage of the Hibernate Validator library, making it subject to CWE-94 (Code Injection). When these vulnerabilities are combined, they present the possibility for unauthenticated remote code execution, amplifying the risk significantly.
The vulnerabilities were initially reported by CERT-EU, the European Union’s cybersecurity body. They exploit weaknesses in the execution order of Spring MVC’s argument resolution process, as detailed by security researchers from ProjectDiscovery. The flaw involves the binding of query parameters to the DeviceFeatureUsageReportQueryRequest, triggering validation processes that ultimately allow attackers to inject malicious code before security measures are applied.
Affected endpoints include “/api/v2/featureusage” and “/api/v2/featureusage_history”, both of which are vulnerable due to insecure implementations of Spring Framework and Hibernate Validator libraries. A proof-of-concept exploit was published on GitHub by WatchTower Labs on May 15, which has greatly increased the potential for widespread exploitation.
As of May 19, 798 instances remained exposed to this vulnerability, a decrease from 940 just a few days prior, according to reports from the Shadowserver Foundation. This marks yet another security incident for Ivanti, following several vulnerabilities discovered earlier this year. In January, Ivanti Connect Secure VPN devices were exploited through zero-day flaws, and in March, three critical vulnerabilities in Ivanti Endpoint Management were added to the KEV catalog. Additionally, a severe vulnerability in Ivanti Connect Secure (CVE-2025-22457) was added to the catalog in April after being exploited by Chinese state-sponsored actors in cyber espionage activities.
| Vulnerabilities | Affected Products | Impact | Exploit Requirements | CVSS 3.1 Score |
|---|---|---|---|---|
| CVE-2025-4427 | Ivanti EPMM ≤12.5.0.0 (on-premises deployments) | Authentication bypass via API, allowing access to restricted resources | Network access to EPMM API endpoints | 5.3 (Medium) |
| CVE-2025-4428 | Ivanti EPMM ≤12.5.0.0 (on-premises deployments) | Remote code execution (RCE) via code injection in API requests | Network access to EPMM API endpoints; Authentication (bypassed through CVE-2025-4427) | 7.2 (High) |
Recommended Actions for Ivanti EPMM Users
To mitigate risks, Ivanti EPMM users are urged to update to the following patched versions: 11.12.0.5, 12.3.0.2, 12.4.0.2, or 12.5.0.1.
Alternatively, Ivanti suggests utilizing API filtering via Portal ACLs or deploying an external Web Application Firewall (WAF) as a precautionary measure.
It’s important to note that the vulnerabilities only impact on-premises Ivanti EPMM deployments. Other Ivanti solutions, including Ivanti Neurons for MDM, Ivanti Sentry, and similar products, are unaffected.
Since its inception in November 2021, CISA’s Known Exploited Vulnerabilities (KEV) catalog has expanded significantly. In 2024 alone, 185 new vulnerabilities were added, bringing the total to 1,238 high-risk software and hardware flaws. This catalog is a vital tool for both public and private sectors to prioritize vulnerability management efforts in the face of evolving cyber threats.
