---
title: "Ivanti EPMM CVE-2025-4427/4428: Exploited Pre-Auth RCE"
url: https://erroneo.us/security/briefs/ivanti-epmm-cve-2025-4427-4428-auth-bypass-rce/
description: "Two chained EPMM API bugs gave unauthenticated RCE and were exploited by a China-nexus group in May 2025. Fixed in 12.5.0.1 and peers. Confirm, then hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-05-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-4427", "CVE-2025-4428"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Ivanti EPMM CVE-2025-4427/4428: Exploited Pre-Auth RCE

**Verdict: Check exposure.** Patched in May 2025 but exploited for espionage within days. Confirm every on-prem EPMM server is on a current, fully patched release, then hunt for the web shells, Sliver implants and database dumps seen in those attacks.

- **Who must act:** Anyone who ran on-premises Ivanti EPMM 11.12.0.4, 12.3.0.1, 12.4.0.1, 12.5.0.0 or earlier with its API reachable from the internet in or after May 2025.
- **Who can relax:** Customers of the cloud-hosted Ivanti Neurons for MDM (Ivanti's disclosure covered on-premises EPMM only), and EPMM servers patched before May 15, 2025 whose API was never exposed.
- **Affected:** Ivanti EPMM 11.12.0.4 and earlier; Ivanti EPMM 12.3.0.1 and earlier; Ivanti EPMM 12.4.0.1 and earlier; Ivanti EPMM 12.5.0.0 and earlier
- **Fixed:** Ivanti EPMM 11.12.0.5; Ivanti EPMM 12.3.0.2; Ivanti EPMM 12.4.0.2; Ivanti EPMM 12.5.0.1; Later EPMM releases, which also need Ivanti's January 2026 fix for CVE-2026-1281/CVE-2026-1340
- **CVEs:** CVE-2025-4427, CVE-2025-4428
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Identify every on-premises EPMM appliance and its version; anything below 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1 is vulnerable.
2. Move to a current, supported EPMM release and confirm Ivanti's January 2026 security RPM for CVE-2026-1281 and CVE-2026-1340 is also in place.
3. Restrict /mifs/rs/api/v2/ and /rs/api/v2/ to trusted admin networks with EPMM's Portal ACLs or a WAF.
4. Hunt Tomcat access logs for featureusage requests whose format value is not csv or json.
5. If you find exploitation, rebuild the appliance and rotate the LDAP bind credentials, Microsoft 365 tokens and other secrets stored in the mifs database.

### How to check if you are affected

- Search /mi/tomcat/logs/access-logs.* for /mifs/rs/api/v2/featureusage or featureusage_history requests where format is not csv or json, or contains ${ or exec(.
- Check /tmp, /var/tmp and /mi/tomcat/webapps/mifs/ for unexpected files, including JSP shells such as 401.jsp, session.jsp and baseURL.jsp.
- Look for mysqldump runs against the mifs database, Java heap dumps (jcmd), and outbound connections from the appliance to unfamiliar hosts.
- Compare outbound traffic against published IOCs, for example 103.244.88.125 and 27.25.148.183 from EclecticIQ and 77.221.158.154 from Wiz.

## What happened

On May 13, 2025, Ivanti disclosed two flaws in the API of on-premises Endpoint Manager Mobile (EPMM). [CVE-2025-4427](https://www.cve.org/CVERecord?id=CVE-2025-4427) is an authentication bypass, rated CVSS 3.1 5.3 by Ivanti. [CVE-2025-4428](https://www.cve.org/CVERecord?id=CVE-2025-4428) is an authenticated code injection, rated 7.2. NVD scores them 7.5 and 8.8. Chained, they give unauthenticated remote code execution. Ivanti said a "very limited" number of customers had been compromised at disclosure, per [Help Net Security](https://www.helpnetsecurity.com/?p=330899). It also blamed two open-source libraries. CISA's KEV entries name them as Spring Framework and Hibernate Validator, the latter tracked separately as [CVE-2025-35036](https://www.cve.org/CVERecord?id=CVE-2025-35036).

[watchTowr](https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/) reversed the patch on May 15 and disputed the framing. Ivanti's own code passes the `format` parameter of `/mifs/rs/api/v2/featureusage` into a validation message, which is then evaluated as Java Expression Language. The validators also run before the authentication check, so no login is needed. watchTowr published a proof of concept the same day.

## Who is affected

On-premises EPMM 11.12.0.4, 12.3.0.1, 12.4.0.1, 12.5.0.0 and earlier releases on each line are affected. The fixes are 11.12.0.5, 12.3.0.2, 12.4.0.2 and 12.5.0.1. EPMM servers are commonly internet-facing so managed phones can reach them, which made exposure broad. [CERT-EU](https://cert.europa.eu/publications/security-advisories/2025-018) relays Ivanti's interim advice: restrict API access with the Portal ACL feature or a WAF.

## Do you really need to act?

For most teams this is now a verification and hunting job, not a patch race. Exploitation was fast and targeted. [Wiz](https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-exploited-in-the-wil-cve-2025-4427-cve-2025-4) saw attacks from May 16, with Sliver beacons, MySQL dumps and JSP web shells. [EclecticIQ](https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability) attributes intrusions from May 15 onward to a China-nexus espionage group. Victims were in government, healthcare, telecoms, aviation, finance and defense across Europe, North America and Asia-Pacific. The attackers deployed KrustyLoader and Sliver and used hardcoded MySQL credentials to dump LDAP users, device details and Office 365 tokens.

EPMM was hit again by unauthenticated zero-days in January 2026. That attack used different bugs, covered in our brief on CVE-2026-1281 and CVE-2026-1340. A server still missing the May 2025 fix is almost certainly missing that one too. Treat it as compromised.

## What to do now

1. Inventory on-prem EPMM appliances and versions. Anything below the fixed builds above is vulnerable.
2. Upgrade to a current supported release, and confirm the January 2026 security RPM is installed as well.
3. Limit `/mifs/rs/api/v2/` and `/rs/api/v2/` to admin networks with Portal ACLs or a WAF.
4. Run EclecticIQ's pattern over the access logs: `grep -E "format=.*exec(%28|\()" /mi/tomcat/logs/access-logs.*`.
5. If you find exploitation, rebuild the appliance. Then rotate the LDAP bind account, Microsoft 365 tokens and any other secrets EPMM stores.

## How to tell if you were hit

Ivanti said it had no reliable atomic indicators at disclosure. Use the researchers' findings instead. Look for requests to `featureusage` or `featureusage_history` whose `format` is not `csv` or `json`, or that contain `${` expressions. Check `/tmp` (EclecticIQ saw `/tmp/1` and `/tmp/.alog`) and the mifs webapp directory for JSP shells such as `401.jsp`. Watch for `mysqldump` runs against `mifs`, heap dumps via `jcmd`, and outbound connections to published IOCs such as `103.244.88.125`. Wiz notes that reverse shells launched through the injection may leave no file artifacts, so a clean filesystem does not prove a clean box.

## Timeline

- May 13, 2025 — Ivanti discloses both CVEs with fixed releases and confirms limited prior exploitation.
- May 15, 2025 — watchTowr publishes its analysis and proof of concept. EclecticIQ's earliest observed attacks date to the same day.
- May 16, 2025 — Wiz observes ongoing in-the-wild exploitation.
- May 19, 2025 — CISA adds both CVEs to KEV, with a federal due date of June 9, 2025.
- May 21, 2025 — EclecticIQ ties the attacks to a China-nexus espionage group.
- Jun 3, 2025 — CVE-2025-35036 is published for Hibernate Validator's insecure Expression Language interpolation.
- Jan 29, 2026 — Ivanti discloses new EPMM zero-days, CVE-2026-1281 and CVE-2026-1340.

## Sources

1. [CVE record — CVE-2025-4427](https://www.cve.org/CVERecord?id=CVE-2025-4427)
2. [CVE record — CVE-2025-4428](https://www.cve.org/CVERecord?id=CVE-2025-4428)
3. [NVD — CVE-2025-4427](https://nvd.nist.gov/vuln/detail/CVE-2025-4427)
4. [NVD — CVE-2025-4428](https://nvd.nist.gov/vuln/detail/CVE-2025-4428)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-4427](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4427)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-4428](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4428)
7. [CVE record — CVE-2025-35036 (Hibernate Validator EL interpolation)](https://www.cve.org/CVERecord?id=CVE-2025-35036)
8. [watchTowr Labs — Expression Payloads Meet Mayhem: CVE-2025-4427 and CVE-2025-4428](https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/)
9. [EclecticIQ — China-Nexus Threat Actor Actively Exploiting Ivanti EPMM (CVE-2025-4428)](https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability)
10. [Wiz — Ivanti EPMM RCE vulnerability chain exploited in the wild](https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-exploited-in-the-wil-cve-2025-4427-cve-2025-4)
11. [CERT-EU — Security Advisory 2025-018: Critical vulnerabilities in Ivanti EPMM](https://cert.europa.eu/publications/security-advisories/2025-018)
12. [Help Net Security — Ivanti EPMM vulnerabilities exploited in the wild](https://www.helpnetsecurity.com/?p=330899)

---
Source page: https://erroneo.us/security/briefs/ivanti-epmm-cve-2025-4427-4428-auth-bypass-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt