Ivanti patches two zero-days under active attack as intel agency warns customers

Australia's intelligence agency is warning organizations about several new Ivanti zero-days chained for remote code execution (RCE) attacks. The vendor itself has said the vulns are linked to two mystery open source libraries which it declined to name. The Australian Signals Directorate (ASD) issued a critical warning about CVE-2025-4427 (5.3) and CVE-2025-4428 (7.2) earlier today. Individually, the two bugs seem fairly unalarming, but together they can be, and have been, used to exploit Ivanti customers. We are actively working with our security partners and the maintainers of the libraries to determine if a CVE against the libraries is warranted for the benefit of the broader security ecosystem "We are aware of a very limited number of customers whose solution has been exploited at the time of disclosure," said Ivanti in its advisory, which was released alongside the patches for Ivanti Endpoint Manager Mobile (EPMM). EPMM is used by Ivanti customers to manage company-issued devices and applications on those devices, while providing secure access to sensitive or confidential content such as company documents. Although EPMM can be used by all types of organizations, the ASD's advisory stated that the information was intended for large organizations and government entities, suggesting the EPMM vulnerabilities are less likely to affect smaller companies. The affected EPMM versions include: All four series of the software have patches available, but if customers can't apply them...