<ul><li>Two new security flaws, CVE-2025-4427 and CVE-2025-4428, in Ivanti Endpoint Manager Mobile (EPMM) software have been discovered, allowing for remote code execution without authentication.</li><li>The importance of proactive threat detection in light of the increasing number of vulnerabilities, as seen with over 18,000 logged by NIST in the first half of 2025, is emphasized.</li><li>Ivanti has addressed the vulnerabilities in the API component of EPMM software, where CVE-2025-4427 is an authentication bypass, and CVE-2025-4428 is an RCE flaw, impacting on-premises EPMM instances.</li><li>Defenders recommend applying the available patches to mitigate the risks associated with CVE-2025-4427 and CVE-2025-4428, found in EPMM versions up to 12.5.0.0.</li></ul>

CVE-2025-4427 and CVE-2025-4428 Detection: Ivanti EPMM Exploit Chain Leading to RCE

Discover more