CVE-2025-4427: Ivanti Endpoint Manager Mobile API authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe vulnerability is remotely exploitable without authentication, has a very high EPSS score, and is listed in CISA KEV as actively exploited.

What it is

Ivanti Endpoint Manager Mobile 12.5.0.0 and earlier contains an authentication bypass in its API component, allowing access to protected resources without valid credentials. The flaw is remotely reachable with no authentication or user interaction, and it is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An unauthenticated attacker can reach protected API resources, exposing sensitive data and functionality normally restricted to authenticated users. The CVSS vector indicates high confidentiality impact with no integrity or availability impact.

Attack surface

Reachable over the network through the EPMM API (AV:N, AC:L, PR:N, UI:N). No authentication or user interaction is required to attempt exploitation.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-05-19 with a remediation due date of 2025-06-09, indicating active exploitation. EPSS probability is 0.99927 (99.968th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor patch or mitigation from the Ivanti security advisory for EPMM immediately.
• If patching is not possible, follow CISA BOD 22-01 guidance or discontinue use of the affected product.
• Restrict network access to the EPMM API to trusted management networks and block untrusted sources.
• Monitor Ivanti advisories for updated fixed versions and verify the deployed version is no longer 12.5.0.0 or earlier.
• Review EPMM logs for unauthorized API access attempts and rotate any credentials or secrets that may have been exposed.

Detection

• Hunt EPMM API logs for requests to protected endpoints that succeed without a valid authenticated session.
• Alert on anomalous or unexpected source IPs accessing EPMM API endpoints.
• Correlate EPMM authentication logs for missing or failed authentication followed by successful resource access.
• Monitor for known exploitation indicators published by Ivanti or CISA for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.