CVE-2025-4428: Ivanti Endpoint Manager Mobile API code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is listed in CISA KEV with active exploitation, has a very high EPSS score, and allows remote code execution on a central management server.

What it is

Ivanti Endpoint Manager Mobile (EPMM) 12.5.0.0 and prior contains a code injection flaw in its API component that lets an authenticated attacker execute arbitrary code through crafted API requests. Because EPMM is a mobile device management server, successful exploitation can compromise the management plane used to control enrolled devices.

Impact

An attacker with valid credentials can run arbitrary code on the EPMM server, gaining full control of confidentiality, integrity and availability of that host. From there they could reach managed device data and administrative functions exposed by the platform.

Attack surface

Reachable over the network through the EPMM API (AV:N, AC:L). The vector requires low privileges (PR:L) and no user interaction (UI:N), so any authenticated account able to send API requests is enough.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-05-19 with a remediation due date of 2025-06-09, indicating active exploitation. EPSS gives a 30-day probability of 0.86519 (99.7th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor patch or mitigation from the Ivanti security advisory for EPMM immediately; this is a KEV-listed issue with a 2025-06-09 due date.
• If patching is not possible, follow CISA BOD 22-01 guidance or discontinue use of the product as directed.
• Restrict network access to the EPMM API to trusted management networks and block exposure to the internet.
• Audit and reduce EPMM accounts, enforce least privilege, and rotate credentials for any account that could reach the API.
• Monitor EPMM logs for anomalous API requests and unexpected process execution on the server.

Detection

• Review EPMM API access logs for unusual or malformed requests, especially from accounts that do not normally use the API.
• Hunt for unexpected child processes or command execution spawned by the EPMM service on the server.
• Alert on authentication from new or unusual source IPs to the EPMM administrative/API interface.
• Correlate EPMM server activity with outbound connections to unknown hosts that could indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.