CVE-2025-4427

7.5 highKEVEPSS 100%

High (7.5) in Ivanti Endpoint Manager Mobile (EPMM). In CISA KEV since 2025-05-19. EPSS 100% chance of exploitation in the next 30 days.

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2025-05-19, due 2025-06-09
CWE: CWE-288
Published: 2025-05-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ivanti:endpoint_manager_mobile

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4427

Check your stack JSON