ZeroDay Findings
Sign inSign up

Findings

CVE-2025-4428

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Published May 13, 2025 · updated Jun 17, 2026 · ivanti endpoint manager mobile

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.

Timeline

Detection, updates, and resolution for this record.

  1. May 13, 2025 · Catalog

    Detected

    Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.

  2. May 19, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Jun 9, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Jun 9, 2025

Affected

  • cpe ivanti/endpoint manager mobileversion unspecified
  • cpe ivanti/endpoint manager mobile12.5.0.0
  • vendor Ivanti Endpoint Manager Mobile (EPMM)version unspecified

Sources

  • CISA KEVCVE-2025-4428

    Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.

    cisa.gov
  • CVE.orgCVE-2025-4428

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-4428

    30-day exploitation probability 87.0%

    first.org
  • Metasploit Modulesexploit_multi/http/ivanti_epmm_rce_cve_2025_4427_4428

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_windows/http/commvault_rce_cve_2025_57790_cve_2025_57791

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2025-4428

    Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

    nvd.nist.gov

References