CVE-2025-4428highunder attackCWE-94

CVE-2025-4428: high-severity vulnerability in Ivanti Endpoint Manager Mobile

Remote Code Execution

Published · Updated

Follow this CVE+ Monitor Endpoint Manager Mobile

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.2epss 88%
from disclosure to weapon2 days
Published on NVDMay 13
1st PoC+2d
metasploitMay 13
CISA KEV+6d
Action required by CISAfederal deadline: 2025-06-09

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An authenticated attacker can send specially crafted requests to the API in Ivanti Endpoint Manager Mobile (version 12.5.0.0 and earlier) to execute arbitrary code on the system. This is dangerous because it allows complete control over the affected device.

Technical detail

CWE-94 (Improper Control of Generation of Code) vulnerability in the Ivanti Endpoint Manager Mobile API component allows authenticated users to execute arbitrary code through maliciously crafted API requests. The attack requires prior authentication and affects versions 12.5.0.0 and earlier across unspecified platforms, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Ivanti · Endpoint Manager Mobile
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ivanti Endpoint Manager Mobile

In the same product, most dangerous first.

CVE-2023-35078CRITICALCVE-2023-35078EPSS 100.0%KEVCVE-2025-4427MEDIUMAuthentication BypassEPSS 99.9%KEVCVE-2026-1281CRITICALCVE-2026-1281EPSS 98.7%KEVCVE-2026-1340CRITICALCVE-2026-1340EPSS 98.6%KEVCVE-2026-6973HIGHCVE-2026-6973EPSS 34.5%KEVCVE-2025-6771HIGHOS command injection in Ivanti Endpoint ManagerEPSS 23.0%