CVE-2025-4427

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

99.93% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-05-19

Nuclei

critical · CWE-288

Published

2025-05-13

Updated

2026-02-26

Proof-of-concept exploits (3)

• rxerium/CVE-2025-4427-CVE-2025-44280★ · 2025-10-14
• watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-442811★ · 2025-05-15
• xie-22/CVE-2025-44284★ · 2025-10-11

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4427.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ivanti_epmm_rce_cve_2…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52421

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2025/CVE-2025-4427.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-24086
• CVE-2022-41352
• CVE-2023-22515
• CVE-2023-40000
• CVE-2023-6000
• CVE-2024-12084