CVE-2025-10243

Deeper analysis

CVE-2025-10243 is an OS command injection vulnerability, tracked under CWE-78, that affects the admin panel of Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4. The flaw carries a CVSS 3.1 base score of 7.2 and permits execution of arbitrary operating system commands when triggered through the administrative interface.

A remote attacker who already possesses valid administrator credentials can supply crafted input to the affected admin panel functions, resulting in arbitrary code execution on the underlying server with the privileges of the EPMM process. No user interaction or additional network-adjacent access is required beyond the initial authenticated session.

The vendor advisory published by Ivanti recommends immediate upgrade to one of the fixed releases (12.6.0.2, 12.5.0.4, or 12.4.0.4) and notes that the issue is resolved in those builds; organizations should apply the patches according to their normal change-management processes and review administrative access controls in the interim. The associated EPSS score has remained flat at 0.0923 with no material increase observed since disclosure.