Active Exploitation of Zero-Day Vulnerabilities in Ivanti Endpoint Manager Mobile
Ivanti has addressed two exploited vulnerabilities that, when chained, could lead to unauthenticated remote code execution
Summary
Ivanti has addressed two exploited vulnerabilities that, when chained, could lead to unauthenticated remote code execution
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation of CVE-2025-4427 and CVE-2025-4428 Affecting NHS Organisations
Ivanti has observed exploitation of CVE-2025-4427 and CVE-2025-4428 in the wild. The NHS England National Cyber Security Operations Centre assesses further exploitation as highly likely.
Update - There have been several public reports of broad exploitation of these vulnerabilities targeting multiple industrial sectors across multiple countries.
NHS England National CSOC is aware of reports that two NHS trusts have been impacted by exploitation of CVE-2025-4427 and CVE-2025-4428. CSOC teams are working with the affected organisations to investigate and offer support. These are active investigations and updates will be provided when new or relevant information becomes available.
Introduction
Ivanti has released a security advisory addressing two vulnerabilities affecting Endpoint Manager Mobile (EPMM). Ivanti EPMM provides an all-in-one solution for managing mobile, macOS and Windows devices within a network.
Ivanti has observed exploitation of the two vulnerabilities in the wild.
Vulnerability Details
- CVE-2025-4427 is an 'authentication bypass' vulnerability with a CVSSv3 score of 5.3. If exploited, an unauthenticated attacker could gain access to protected resources.
- CVE-2025-4428 is a 'remote code execution' vulnerability with a CVSSv3 score of 7.3. If exploited an authenticated attacker could execute arbitrary code via crafted API requests.
When chained together, successful exploitation of CVE-2025-4427 and CVE-2025-4428 could lead to unauthenticated remote code execution.
Threat updates
| Date | Update |
|---|---|
| 28 May 2025 |
Updated Exploitation Details
Additional information added surrounding exploitation of CVE-2025-4427 and CVE-2025-4428 |
Remediation advice
Affected organisations must review the Ivanti Security Advisory and apply the relevant updates as soon as practicable.
Note: Organisations must apply the relevant security update before marking this high severity Cyber Alert as complete.
Remediation steps
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 28 May 2025 6:12 pm