CVE-2025-4428

Deeper analysis

CVE-2025-4428 is a remote code execution vulnerability in the API component of Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and earlier. The flaw, assigned CWE-94, permits code injection through specially crafted requests and carries a CVSS 3.1 score of 7.2 reflecting high impact on confidentiality, integrity, and availability when successfully exploited.

Authenticated attackers with administrative API access can send malicious requests that result in arbitrary code execution on the affected server. Because the attack requires valid high-privilege credentials and targets the network-accessible API, it is most relevant to insiders, compromised administrative accounts, or attackers who have already obtained such credentials.

Ivanti’s security advisory and the associated CISA entry direct customers to apply the vendor-supplied patches for EPMM and to review the hardening guidance published in the advisory. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation. The EPSS score rose from low values to a peak of 0.6390 on 2025-12-18 before receding to the current 0.4098, indicating a clear post-disclosure increase in exploitation interest that warrants renewed attention.