CVE-2025-4428

Ivanti Endpoint Manager Mobile (EPMM) Code Injection vulnerability (CVE-2025-4428). An authenticated attacker can remotely execute arbitrary code via crafted API requests in the API component. Root cause cited as insecure implementation/interpolation involving the Hibernate Validator library, wit...

CVE-2025-4428 Remote Code Execution

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests...

CVE-2025-4427 Authentication Bypass

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API...

CVE-2025-4427 Authentication Bypass

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API...

CVE-2025-4427

CVE-2025-4427 affects Ivanti Endpoint Manager Mobile (EPMM) up to and including version 12.5.0.0 (and earlier). The vulnerability is an authentication bypass in the API component , allowing an attacker to access protected resources without credentials via crafted API requests. Root cause cited in...

Security Advisory Ivanti Endpoint Manager Mobile (EPMM) May 2025 (CVE-2025-4427 and CVE-2025-4428)

Ivanti has released updates for Endpoint Manager Mobile EPMM which addresses one medium and one high severity vulnerability. When chained together, successful exploitation could lead to unauthenticated remote code execution. We are aware of a very limited number of customers whose solution has be...

Ivanti Endpoint Manager Mobile 12.5.0.x < 12.5.0.1 / 12.4.0.x < 12.4.0.2 / 12.x < 12.3.0.2 / 11.x < 11.12.0.5 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is 12.5.0.x prior to 12.5.0.1, 12.4.0.x prior to 12.4.0.2, 12.3.0.x prior to 12.3.0.2, or 11.x prior to 11.12.0.5. It is, therefore, affected by multiple vulnerabilities: - An authentication bypass...

PT-2025-20921

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile EPMM versions 12.5.0.0 and prior Description A flaw exists in the API component of Ivanti Endpoint Manager Mobile EPMM that allows authenticated attackers to execute arbitrary code through crafted API requests...

CVE-2025-4427

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. Recent assessments: remmons-r7 at May 22, 2025 5:21am UTC reported: On May 13, 2025, Ivanti published an adviso...

CVE-2025-4428

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. Recent assessments: remmons-r7 at May 22, 2025 5:27am UTC reported: On May 13, 2025, Ivanti...

VulnCheck KEV: CVE-2025-4427

Ivanti Endpoint Manager Mobile EPMM contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring...

Ivanti Endpoint Manager Mobile 安全漏洞

Ivanti Endpoint Manager Mobile EPMM is an enterprise-grade mobile device management solution for centralized management and protection of mobile devices in the enterprise, supporting device enrollment, application distribution, security policy enforcement, and more. An authentication bypass...

Ivanti Endpoint Manager Mobile 代码注入漏洞

Ivanti Endpoint Manager Mobile EPMM is an enterprise-grade mobile device management solution for centralized management and protection of mobile devices in the enterprise, supporting device enrollment, application distribution, security policy enforcement, and more. A code execution vulnerability...

PT-2025-20920

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile EPMM versions 12.5.0.0 and prior Description An authentication bypass exists in the API component of Ivanti Endpoint Manager Mobile. This allows attackers to access protected resources without proper credentials...

VulnCheck KEV: CVE-2025-4428

Ivanti Endpoint Manager Mobile EPMM contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source...

Unspecified Vulnerability in Ivanti Endpoint Manager

Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...

Ivanti Endpoint Manager Pointer Dereference Vulnerability

Ivanti Endpoint Manager is an enterprise-class endpoint management solution for centralized management of all types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc. to achieve unified configuration, security control and remote operation and maintenance. A pointer...

Ivanti Endpoint Manager Code Issue Vulnerability

Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...

Ivanti Endpoint Manager Cross-Site Scripting Vulnerability (CNVD-2025-15470)

Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...

Ivanti Endpoint Manager SQL Injection Vulnerability

Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...