CVE-2025-4427

Ivanti Endpoint Manager Mobile (EPMM), Ivanti's on-premises mobile device management platform, contains an authentication bypass (CWE-288) in its API component caused by an insecure implementation of the Spring Framework library. An unauthenticated attacker can send crafted API requests to access protected resources without valid credentials. Successful exploitation grants access to sensitive management functionality and data in the MDM platform, which could serve as a foothold for further compromise of a managed-device estate. Any organization running Ivanti EPMM is potentially affected, particularly where the API is reachable from the internet or untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2025-05-19 and carries an EPSS probability of 99.9% of being exploited within 30 days.

What to do: Upgrade EPMM to the patched releases specified in Ivanti's advisory (exact version numbers were not included in the source data), prioritizing internet-facing instances; federal agencies must apply the required action per BOD 22-01 or follow vendor mitigation guidance or discontinue use if mitigations are unavailable. Review API and web server logs for unauthenticated access to protected resources to check for compromise, since CISA's KEV listing confirms active exploitation. No public proof-of-concept is known, but with EPSS at 99.9% treat this as an urgent patch.