High severity · published May 13, 2025
CVE-2025-4427
Authentication Bypass
In wildKEV
7.5
CVSS
99.9%
EPSS
Yes
On KEV
Description
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 19, 2025
Federal remediation dueJun 9, 2025
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager Mobile · Ivanti
before 11.12.0.5; 12.3.0.0 before 12.3.0.2; 12.4.0.0 before 12.4.0.2; 12.5.0.0 · source: vendor, NVD
EM
Endpoint Manager Mobile (EPMM) · Ivanti
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4427
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
forums.ivanti.com
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
More from Endpoint Manager Mobile
9.8
CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
9.8
CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
9.8
CVE-2023-35082
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
9.8
CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
8.8
CVE-2025-4428
Remote Code Execution