CVE-2025-4428 Ivanti Endpoint Manager Mobile (EPMM) Code Injection

Exploited in the wild High 7.2 Published 13 May 2025 Updated 26 Feb 2026

Authenticated attackers can execute arbitrary code via crafted API requests in Ivanti Endpoint Manager Mobile.

Exploited in the wild: Since 19 May 2025
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-4428?

CVE-2025-4428 is a high-severity code injection vulnerability in Ivanti Endpoint Manager Mobile, published on 13 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

Weakness: CWE-94

Which versions are affected by CVE-2025-4428?

It affects 1 product.

Products include Ivanti Endpoint Manager Mobile.

How do I fix CVE-2025-4428?

No fix has been published for CVE-2025-4428 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 9 Jun 2025.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-4428 being exploited?

Yes. Attackers have exploited CVE-2025-4428 in the wild since at least 19 May 2025.

Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-g4m9-9h4j-22xx.