CVE-2025-4428: Remote Code Execution
First published: Tue May 13 2025(Updated: )
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library.
Credit: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ivanti Endpoint Manager Mobile (EPMM) | <12.5.0.0 | |
| Ivanti Endpoint Manager Mobile |
Remedy
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.bleepingcomputer.com/news/security/ivanti-fixes-epmm-zero-days-chained-in-code-execution-attacks/
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
- https://www.theregister.com/2025/05/14/ivanti_patches_two_zerodays_and/
- https://nvd.nist.gov/vuln/detail/CVE-2025-4428
Frequently Asked Questions
What is the severity of CVE-2025-4428?
CVE-2025-4428 has a critical severity level due to its potential for remote code execution.
How do I fix CVE-2025-4428?
To mitigate CVE-2025-4428, users should upgrade to Ivanti Endpoint Manager Mobile version 12.5.0.1 or later.
What systems are affected by CVE-2025-4428?
CVE-2025-4428 affects Ivanti Endpoint Manager Mobile versions 12.5.0.0 and earlier on unspecified platforms.
Can unprivileged users exploit CVE-2025-4428?
Yes, CVE-2025-4428 allows authenticated attackers, including unprivileged users, to execute arbitrary code.
Is there an exploit available for CVE-2025-4428?
While specific exploits for CVE-2025-4428 are not publicly detailed, the nature of the vulnerability suggests that crafted API requests can be used to exploit it.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2025-4427
- alias/CVE-2025-4428
- alias/CVE-2025-22462
- alias/CVE-2025-22460
- collector/nvd-api
- source/NVD
- collector/the-register
- source/The Register
- agent/news-ai
- zeroday/true
- exploited/true
- agent/severity
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- collector/cisa-known-exploited
- source/CISA
- agent/remedy
- agent/references
- agent/source
- agent/description
- agent/softwarecombine
- agent/trending
- agent/event
- agent/tags
- collector/nvd-cve
- vendor/ivanti
- canonical/ivanti endpoint manager mobile (epmm)
- canonical/ivanti endpoint manager mobile