CVE-2025-4427

What it actually does

This is an authentication bypass in the Ivanti Endpoint Manager Mobile API component. An unauthenticated remote attacker can reach API resources that should require valid credentials, allowing access to protected management functions or sensitive EPMM-managed data depending on the exposed endpoint and product configuration. Because EPMM is a mobile device management platform, successful exploitation can expose device, user, enrollment, policy, and administrative information, and it may be used as a foothold for follow-on attacks or chained with other appliance vulnerabilities.

Why it matters to the business

Ivanti Endpoint Manager Mobile commonly has high operational value because it manages mobile devices, security policies, enrollment, and access controls. Unauthorized API access can lead to exposure of managed device and user information, disruption of mobile management operations, and increased risk of broader compromise if attackers use the platform to identify privileged users or chain additional vulnerabilities. This issue is listed in CISA KEV, has active in-the-wild exploitation, and has an extremely high EPSS score, so internet-exposed instances should be treated as urgent even though ransomware use is not currently flagged. The KEV remediation due date was 2025-06-09, so organizations that have not remediated are overdue against federal emergency guidance.

How an attack unfolds

An attacker first identifies an internet-accessible Ivanti Endpoint Manager Mobile instance and probes its API surface. They then send crafted unauthenticated requests to API paths that incorrectly allow access without a valid session, token, or administrative credential. If the target is vulnerable, the API returns protected data or permits actions that should be restricted to authenticated users. In observed Ivanti EPMM zero-day exploitation activity, attackers have used authentication bypass conditions as an initial access mechanism and may pair them with additional vulnerabilities on the same appliance to deepen access, execute commands, exfiltrate data, or maintain persistence. Post-exploitation activity may include enumerating users and devices, reviewing policy and configuration data, harvesting sensitive metadata, testing administrative functions, and staging further exploitation from infrastructure that blends with normal web traffic.

How to fix it

Upgrade Ivanti Endpoint Manager Mobile instances running 12.5.0.0 or earlier to a vendor-supported fixed release. No exact fixed version was provided in the input, so use the latest Ivanti security advisory and install the currently recommended maintenance release or hotfix for the deployed branch. Prioritize internet-facing EPMM systems and any systems accessible from untrusted networks. Until patching is complete, restrict EPMM administrative and API access to trusted management networks or VPN, block direct internet access where operationally feasible, enforce allowlisting at reverse proxies or firewalls, and monitor or rate-limit API requests. If exploitation is suspected, preserve logs before rebooting or upgrading, rotate administrative credentials and API secrets, review EPMM administrator accounts and integrations, validate device and policy integrity, and consider rebuilding the appliance from trusted media if there are signs of command execution or persistence.

How to confirm the fix worked

Confirm the installed Ivanti EPMM version is newer than the affected 12.5.0.0-and-prior range and matches the vendor advisory’s fixed release for the deployed branch. Verify that all nodes in clustered or high-availability deployments are patched. From an unauthenticated test client, attempt to access protected API resources and confirm the server returns 401 Unauthorized or 403 Forbidden rather than protected data or successful responses. Review reverse proxy, WAF, and application access logs after patching to ensure unauthenticated API access attempts are denied. Validate that EPMM admin/API interfaces are not directly reachable from the public internet unless explicitly required and protected by network controls. Run authenticated application health checks after the upgrade to confirm enrollment, policy delivery, device check-in, and administrator workflows still operate normally.

Typical attack path

1. Scan the internet for exposed Ivanti Endpoint Manager Mobile or MobileIron Core services.
2. Fingerprint the product and version through headers, login pages, API responses, or known EPMM URL paths.
3. Send unauthenticated requests to protected API endpoints affected by the authentication bypass.
4. Confirm exploitation by receiving HTTP 200/3xx responses or protected API data without a valid Authorization header, API token, or session cookie.
5. Enumerate users, devices, enrollment data, policies, configuration, or administrative metadata available through the API.
6. Use the obtained information to support credential attacks, privilege escalation, lateral movement, or chaining with another EPMM vulnerability.
7. Attempt to hide activity by limiting request volume, using common user agents, rotating source infrastructure, or blending into normal API traffic.

How to detect it

Review EPMM application logs, web access logs, reverse proxy logs, WAF events, load balancer logs, firewall flow logs, and centralized syslog for API requests that returned successful responses without an associated authenticated session, API token, or Authorization header. Focus on activity from 2025-05-13 onward, especially before patching, and prioritize internet-originating requests to EPMM API paths with HTTP 200, 201, 204, 302, or large response sizes. Look for high-volume enumeration of API endpoints, sequential object access, unusual user agents, access from cloud/VPS/Tor/proxy infrastructure, requests outside normal administrative geographies or business hours, and repeated probing followed by successful API responses. Compare successful API calls with EPMM audit records to determine whether they map to a legitimate administrator or integration. Also hunt for post-exploitation artifacts that may indicate chaining, including unexpected child processes spawned by the EPMM web service, outbound connections from the appliance to unknown hosts, newly created or modified administrative accounts, changed enrollment or compliance policies, unusual certificate or token activity, configuration exports, and files written to temporary or web-accessible directories.

• /mifs/rs/api/
• /mifs/aad/api/
• GET /mifs/rs/api/
• POST /mifs/rs/api/
• GET /mifs/aad/api/
• POST /mifs/aad/api/
• Authorization:
• JSESSIONID
• curl/
• python-requests/
• Go-http-client/
• wget/
• java.*sh
• java.*bash
• java.*curl
• java.*wget
• java.*nc
• java.*python
• java.*perl

What your security team should do

• Immediately inventory all Ivanti Endpoint Manager Mobile and MobileIron Core instances, including internet-facing, disaster recovery, lab, and dormant systems.
• Patch or upgrade all EPMM 12.5.0.0 and earlier deployments to the vendor-recommended fixed release, prioritizing externally reachable systems.
• Because this is KEV-listed and actively exploited, perform compromise assessment even if patching has already occurred.
• Restrict EPMM API and administrative access to trusted IP ranges, VPN, or zero-trust access controls; avoid exposing management/API interfaces directly to the internet.
• Search historical web, reverse proxy, WAF, and EPMM logs from at least 2025-05-13 onward for unauthenticated access to protected API paths and unusual API enumeration.
• Review EPMM administrator accounts, API integrations, enrollment settings, certificates, tokens, and recent configuration changes for unauthorized modifications.
• Correlate EPMM activity with identity provider logs, VPN logs, and endpoint telemetry to identify follow-on access using information obtained from the appliance.
• If logs show suspicious API access or signs of chained exploitation, preserve forensic evidence, rotate credentials and secrets associated with EPMM, and consider rebuilding from a clean, patched image.