Skip to content
COOEY

EXPOSURES › CVE-2025-4428

CVE-2025-4428

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2025-05-19 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2025-4428 ↗
⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 rceexploited-in-wildunpatched

Ivanti EPMM API code injection allows remote execution of arbitrary code by authenticated attackers

Ivanti's Endpoint Manager Mobile (EPMM) suffered a critical code injection vulnerability, enabling attackers to execute arbitrary code via its API. This has been exploited in the wild by Chinese state-sponsored groups, leading to breaches in government agencies.

Shame score — Critical code injection vulnerability exploited in the wild by Chinese state-sponsored groups leading to breaches in government agencies.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED
Ivanti · vendorEndpoint Manager Mobile (EPMM) · product
DESCRIPTION

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.

AFFECTED FEDRAMP PRODUCTS · 2
PRODUCTSTATUS
Ivanti Neurons for ITSM (Formerly Service Manager)
Ivanti
 Authorized
Ivanti Neurons for MDM (Formerly MobileIron)
Ivanti
 Authorized