Ivanti Patches EPMM Vulnerabilities Exploited for Remote Code Execution in Limited Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-22462 | An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthentic An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system. NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2025-4428 +1 in the same advisory: …4427 | Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API CVE-2025-4428 is a code injection flaw (CWE-94) in the API component of Ivanti Endpoint Manager Mobile (EPMM) that lets an authenticated, low-privileged remote attacker execute arbitrary code by sending crafted API requests. Successful exploitation yields code execution on the MDM server itself (CVSS 8.8, High), which typically holds device inventory and administrative control over an organization's enrolled mobile fleet. Any organization running EPMM 12.5.0.0 or earlier is in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-05-19, EPSS puts the 30-day exploitation probability at 86% (100th percentile), and public reporting ties limited attacks to the China-linked actor UNC5221, who reportedly began exploiting it alongside the companion API authentication bypass CVE-2025-4427 shortly after disclosure. CISA has also warned that threat actors exploiting these EPMM flaws deploy two malware strains; ransomware involvement has not been confirmed. Do: Upgrade every EPMM instance running 12.5.0.0 or earlier to the patched release per Ivanti's security advisory, prioritizing internet-facing servers, and note that federal agencies must satisfy the BOD 22-01 required action (patch, apply vendor mitigations, or discontinue use of the product). If patching is delayed, restrict internet exposure of the API and review EPMM logs and the advisory's indicators of compromise, since attackers have chained this flaw with the CVE-2025-4427 authentication bypass and deployed malware. Treat any unpatched, exposed EPMM instance as actively targeted until it is remediated. | 8.8 group max | 87% | KEV |
| largetens of thousands of enterprise deployments (order of 10k-100k EPMM servers; many are internet-exposed) |
Full article633 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 14, 2025Vulnerability / Endpoint Security
Ivanti has released security updates to address two security flaws in Endpoint Manager Mobile (EPMM) software that have been chained in attacks to gain remote code execution.
The vulnerabilities in question are listed below -
- CVE-2025-4427 (CVSS score: 5.3) - An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials
- CVE-2025-4428 (CVSS score: 7.2) - A remote code execution vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to execute arbitrary code on the target system
An attacker that successfully exploits these flaws could chain them together to execute arbitrary code on a vulnerable device without authentication.
The flaws impact the following versions of the product -
- 11.12.0.4 and prior (Fixed in 11.12.0.5)
- 12.3.0.1 and prior (Fixed in 12.3.0.2)
- 12.4.0.1 and prior (Fixed in 12.4.0.2)
- 12.5.0.0 and prior (Fixed in 12.5.0.1)
Ivanti, which credited CERT-EU for reporting the issues, said it's "aware of a very limited number of customers who have been exploited at the time of disclosure" and that the vulnerabilities are "associated with two open-source libraries integrated into EPMM."
The company, however, did not disclose the names of the impacted libraries. It's also not known what other software applications relying on the two libraries could be affected. Furthermore, the company said it's still investigating the cases, and that it does not have reliable indicators of compromise associated with the malicious activity.
"The risk to customers is significantly reduced if they already filter access to the API using either the built-in Portal ACLs functionality or an external web application firewall," Ivanti noted.
"The issue only affects the on-prem EPMM product. It is not present in Ivanti Neurons for MDM, Ivanti’s cloud-based unified endpoint management solution, Ivanti Sentry, or any other Ivanti products."
Separately, Ivanti has also shipped patches to contain an authentication bypass flaw in on-premise versions of Neurons for ITSM (CVE-2025-22462, CVSS score: 9.8) that could allow a remote unauthenticated attacker to gain administrative access to the system. There is no evidence that the security defect has been exploited in the wild.
With zero-days in Ivanti appliances becoming a lightning rod for threat actors in recent years, it's imperative that users move quickly to update their instances to the latest versions for optimal protection.
Update
watchTowr Labs has released a proof-of-concept (PoC) for the Ivanti EPMM exploit chain that combines CVE-2025-4427 and CVE-2025-4428 to achieve unauthenticated remote code execution.
The cybersecurity company noted that, while a third-party called "hibernate-validator" has been updated from version 6.0.22 to 6.2.5, it found that it was able to successfully execute arbitrary commands by sending a specially crafted HTTP GET request to "/mifs/admin/rest/api/v2/featureusage."
It also pointed out CVE-2025-4427 isn't actually an authentication bypass, but more of an order of operations vulnerability, which occurs when logic flaws exist within the order in which security boundaries are applied in code. "Is this really a vulnerability in a third-party library, or incorrect and dangerous usage of known-scary functions?," security researcher Piotr Bazydlo posed.
Wiz Warns of Ivanti EPMM RCE Vulnerability Chain Exploitation
Cloud security company Wiz said it has observed ongoing exploitation of CVE-2025-4427 and CVE-2025-4428 targeting susceptible EPMM instances since May 16, 2025, coinciding with the release of PoC by watchTowr and ProjectDiscovery.
Successful exploitation has been followed by the deployment of command-and-control (C2) frameworks like Sliver that uses the IP address 77.221.157[.]154 as its C2 server.
CVE-2025-4428 "arises from the unsafe handling of user-supplied input within error messages processed via Spring's AbstractMessageSource, which allows attacker-controlled EL (Expression Language) injection," Wiz researchers said. "CVE-2025-4427 is an authentication bypass caused by improper request handling in EPMM's route configuration."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/ivanti-patches-epmm-vulnerabilities.html