Medium KEV-listed

CVE-2025-4427

Ivanti EPMM Authentication Bypass and RCE Exploitation (CVE-2025-4427, CVE-2025-4428)

Vendor / product: Ivanti EPMM

Event date: 2025-05-15

Public PoC: Yes

First tracked by RiskWire: 2026-10-10

CISA KEV catalog

Added to KEV

2025-05-19 ↗

Federal remediation due

2025-06-09 (488 days overdue)

Ransomware campaign use

Unknown

CISA description

Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Sources & citations (1)

Ivanti EPMM Authentication-Bypass and RCE Chain Continues to Draw Exploitation Attempts mallory.ai · 2026-10-09

References

View on NVD ↗ View on MITRE CVE ↗ Search CISA ↗ KEV lookup tool

See CVE-2025-4427 in context

RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.

Book a 20-min demo →