7.5

CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

CVSS: 7.5v3.1HighKEVAnalyzed
Published 13-05-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-4427 is a high (CVSS 7.5) vulnerability in Ivanti Endpoint Manager Mobile (EPMM). It is known to be exploited: CISA and ENISA list it, first on 19-05-2025. EPSS estimates a 99.93% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
99.93%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA · ENISA
RansomwareNone recordedNo known use recorded
Public exploits2exploit-database, metasploit

Timeline

  1. 13-05-2025
    PublishedVulnerability first disclosed.
  2. 19-05-2025
    Added to CISA KEVIvanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
  3. 09-06-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 26-02-2026
    Last modifiedVulnerability information updated.
  5. 08-04-2026
    Added to ENISA KEVAdded to the ENISA known exploited vulnerabilities catalog.

Description

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

99.93%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.93% on 20-09-2026

20-09-202620-10-2026
EPSS score
99.93%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
19-05-2025
Federal due date
09-06-2025
ENISA CNWListed
Added
08-04-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM nvd.nist.gov/vuln/detail/CVE-2025-4427

Public exploits

2 found
  • exploit-databaseremotemultipleUnverified

    Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Ivanti EPMM Authentication Bypass for Expression Language Remote Code Execution

    exploit/multi/http/ivanti_epmm_rce_cve_2025_4427_4428

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Ivanti1 product

1 vendor · 1 product

References

2 links