CVE-2025-4427 Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass

Exploited in the wild Medium 5.3 Published 13 May 2025 Updated 26 Feb 2026

Attackers can bypass authentication in the API to access protected resources without credentials in Ivanti Endpoint Manager Mobile.

Exploited in the wild: Since 19 May 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-4427?

CVE-2025-4427 is a medium-severity authentication bypass vulnerability in Ivanti Endpoint Manager Mobile, published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

Weakness: CWE-288

Which versions are affected by CVE-2025-4427?

It affects 1 product.

Products include Ivanti Endpoint Manager Mobile.

How do I fix CVE-2025-4427?

No fix has been published for CVE-2025-4427 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 9 Jun 2025.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-4427 being exploited?

Yes. Attackers have exploited CVE-2025-4427 in the wild since at least 19 May 2025.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.

Sources

Also known as GHSA-9wcp-q959-7mq8.