High severity · published May 13, 2025
CVE-2025-4428
Remote Code Execution
In wildKEV
8.8
CVSS
88%
EPSS
Yes
On KEV
Description
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)88.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 19, 2025
Federal remediation dueJun 9, 2025
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager Mobile · Ivanti
before 11.12.0.5; 12.3.0.0 before 12.3.0.2; 12.4.0.0 before 12.4.0.2; 12.5.0.0 · source: vendor, NVD
EM
Endpoint Manager Mobile (EPMM) · Ivanti
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4428
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
forums.ivanti.com
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
More from Endpoint Manager Mobile
9.8
CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
9.8
CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
9.8
CVE-2023-35082
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
9.8
CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
7.5
CVE-2025-4427
Authentication Bypass