CVE-2025-4428 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-05-13

Added to CISA KEV: 2025-05-19 6 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately upgrade to Ivanti Endpoint Manager Mobile version 12.5.0.1 or later
Review API access logs for suspicious crafted requests or unusual authentication patterns
Implement network segmentation to limit API endpoint exposure if possible
Monitor for unauthorized code execution, file system changes, or privilege escalation
PATCH PRIORITY: CRITICAL - Actively exploited RCE in enterprise-critical infrastructure

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-4428 is a critical Remote Code Execution (RCE) vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and earlier ^[4].

Exploitation and Threat Actor Activity

Active Exploitation: The vulnerability has been confirmed as actively exploited in the wild ^[1]. It is included in the CISA Known Exploited Vulnerabilities (KEV) catalog as of May 19, 2025 ^[2].
Threat Actors: Reports indicate usage by threat actors, including those with a China nexus, for malware deployment and establishing persistence within compromised environments ^[1].
Attack Chains: While CVE-2025-4428 is technically a post-authentication vulnerability, it has been observed being chained with CVE-2025-4427 to achieve unauthenticated remote code execution ^[3] ^[5].

Attack Method and Requirements

Method: The vulnerability exists in the API component of Ivanti EPMM, specifically within the `DeviceFeatureUsageReportQueryRequestValidator` ^[5]. It involves the unsafe handling of user-supplied input within error messages processed via Spring’s `AbstractMessageSource`, which enables Expression Language (EL) injection ^[5].
Requirements:

* Network/Local: It is a remote vulnerability, exploitable over the network ^[4]. * Authentication: It requires an authenticated account to trigger directly, though chaining with other vulnerabilities can bypass this requirement ^[3]. * User Interaction: No user interaction is required for successful exploitation ^[2].

Impact and Availability

Impact: Successful exploitation allows for arbitrary code execution, leading to complete system compromise, unauthorized access to critical functions, and potential lateral movement within enterprise networks ^[1].
Exploit Availability: Proof-of-concept (PoC) material and detailed breakdowns of the exploit chain are publicly available in security research publications.

Affected Versions and Mitigation

Affected Versions: Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and earlier ^[4].
Status: Ivanti has released security advisories and patches to address this vulnerability. Organizations are strongly advised to consult the official Ivanti support portal and CISA guidance for remediation steps ^[2].

Sources

CVE-2025-4428 - Exploits & Severity - Feedly
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated ... This can result in complete system compromise, unauthorized access to critical functions, and potential lateral movement within enterprise environments. The v…
CVE-2025-4428 - Vulnerability Details - OpenCVE
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4428. ...
CVE-2025-4427 - Exploits & Severity - Feedly
Static CVE Timeline Graph.Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.0: 7.2, CVEs: CVE-2025-4427, CVE-2025-4428, Summary: Ivanti released a security advisory addressing two zero-day vulnerabilities in their EPMM products. An attacker could chain those vulnerabil…
CVE-2025-4428 Detail - NVD
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute ...
Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild | Wiz Blog
CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows attacker-controlled EL (Expression Lang…

🔴 CVE-2025-4428