What’s Vulnerable › Vulnerabilities

CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-05-19
• EPSS: 88.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-13 · updated 2026-06-17
• Weakness: CWE-94

Description

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

Affected products

• Ivanti Endpoint Manager Mobile (MobileIron): before 11.12.0.5; from 12.3.0.0 before 12.3.0.2; from 12.4.0.0 before 12.4.0.2; 12.5.0.0 — fixed in 11.12.0.5, 12.3.0.2, 12.4.0.2

How to fix

Upgrade to a fixed version: Ivanti Endpoint Manager Mobile (MobileIron) 11.12.0.5, 12.3.0.2, 12.4.0.2. Check the vendor advisory for mitigations.

References

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4428

Get alerted when CVE-2025-4428 or the next vulnerability affects your stack