CVE-2025-4428

Remote Code Execution

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

Affected

Ivanti · Endpoint Manager Mobile

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

86.98% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-05-19

Published

2025-05-13

Updated

2026-02-26

Proof-of-concept exploits (4)

• rxerium/CVE-2025-4427-CVE-2025-44280★ · 2025-10-14
• strobes-co/strobes-intel-client1★ · 2025-07-12
• watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-442811★ · 2025-05-15
• xie-22/CVE-2025-44284★ · 2025-10-11

Metasploit modules (2)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ivanti_epmm_rce_cve_2…
• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/commvault_rce_cve_2…

Security advisories

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM

References

• CVE Record
• NVD entry

Related

• CVE-2022-24086
• CVE-2022-41352
• CVE-2023-22515
• CVE-2023-40000
• CVE-2023-6000
• CVE-2024-12084