CVE-2025-4427
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
Description
CVE-2025-4427 is a medium-severity authentication bypass vulnerability in the API component of Ivanti Endpoint Manager Mobile (EPMM), affecting version 12.5.0.0 and prior releases. The flaw allows an unauthenticated attacker to access protected API resources without providing valid credentials, bypassing the intended authentication controls entirely. While the CVSS v3.1 base score is 5.3, the real-world impact is significantly amplified because CVE-2025-4427 is commonly chained with CVE-2025-4428 (a code injection vulnerability) to achieve unauthenticated remote code execution. CISA has added CVE-2025-4427 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 9, 2025, and its EPSS score of 90.79% at the 99th percentile indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | < 11.12.0.5; >= 12.3.0.0, < 12.3.0.2; >= 12.4.0.0, < 12.4.0.2; 12.5.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVE-2025-4427 is classified under CWE-288, which describes scenarios where a system requiring authentication can be bypassed through an alternate entry point that does not enforce the same authentication requirements. In Ivanti EPMM, the API component contains an alternate access path that fails to enforce authentication, allowing unauthenticated attackers to reach protected API endpoints and access sensitive resources or trigger privileged operations without providing credentials.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
Impact Analysis
CVE-2025-4427 carries a CVSS v3.1 base score of 5.3 (Medium) with a network-accessible attack vector (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). The scope is unchanged (S:U) and the direct impact is limited to low confidentiality (C:L) with no integrity or availability impact. However, the standalone CVSS score significantly underestimates the real-world severity. This authentication bypass is the critical enabler for CVE-2025-4428, transforming a high-privilege code injection vulnerability into a fully unauthenticated remote code execution chain. The EPSS score of 90.79% at the 99th percentile is among the highest of any vulnerability, confirming that exploitation is near-certain. Organizations running unpatched Ivanti EPMM instances face the risk of complete infrastructure compromise, as attackers can bypass authentication, execute arbitrary code, and gain full control over the mobile device management platform and all managed devices.
Exploit Maturity
CVE-2025-4427 demonstrates the highest level of exploit maturity. CISA has confirmed active exploitation in the wild by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 90.79% at the 99th percentile is exceptionally high, indicating near-certain exploitation activity across the internet. Ivanti has acknowledged the vulnerability in their security advisory. This authentication bypass is the key component in a two-vulnerability exploit chain with CVE-2025-4428 that achieves unauthenticated remote code execution. Ivanti products have been repeatedly targeted by advanced threat actors, and the combination of authentication bypass with code execution makes this vulnerability chain an extremely high-priority target for exploitation.
Remediation
- Apply Ivanti patches immediately. Upgrade EPMM to a patched version: 11.12.0.5 or later for the 11.x branch, 12.3.0.2 or later for the 12.3.x branch, 12.4.0.2 or later for the 12.4.x branch, or a version beyond 12.5.0.0 when available. Refer to the Ivanti security advisory for specific guidance.
- Restrict network access to EPMM API endpoints. Immediately implement firewall rules to prevent direct internet access to the EPMM server. Allow only connections from trusted internal networks and managed devices.
- Ensure CVE-2025-4428 is also patched. Both vulnerabilities must be remediated simultaneously, as they form an exploit chain. Patching only one leaves the system vulnerable to the chained attack.
- Conduct forensic investigation. Review EPMM access logs for unauthenticated API requests to protected endpoints. Look for evidence of unauthorized resource access, unusual data queries, or code execution indicators. Check for new administrative accounts or modified configurations.
- Implement API security monitoring. Deploy API-aware monitoring or a web application firewall (WAF) to detect and block unauthenticated requests to protected EPMM API endpoints as an additional defense layer.
Technical Details
CVE-2025-4427 is an authentication bypass vulnerability in the API component of Ivanti Endpoint Manager Mobile (EPMM). The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a network-accessible attack requiring no privileges, no user interaction, and low complexity, with limited direct confidentiality impact.
The vulnerability exists because the EPMM API component contains an alternate access path that does not enforce the authentication checks applied to normal API access. This is a classic CWE-288 pattern where the application has multiple entry points but fails to apply consistent authentication across all of them. An attacker can reach protected API resources without providing valid credentials by exploiting this alternate path. While the standalone impact is limited to unauthorized read access to protected resources, the vulnerability becomes critical when combined with CVE-2025-4428. The authentication bypass grants unauthenticated access to API endpoints that accept code injection payloads, creating a complete unauthenticated remote code execution chain that is being actively exploited in the wild.
Frequently Asked Questions
Is CVE-2025-4427 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-4427 to the KEV catalog. The EPSS score of 90.79% at the 99th percentile indicates near-certain exploitation. This vulnerability is routinely chained with CVE-2025-4428 to achieve unauthenticated remote code execution.
What products are affected by CVE-2025-4427?
Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior are affected, including versions before 11.12.0.5, versions 12.3.0.0 through 12.3.0.1, and versions 12.4.0.0 through 12.4.0.1.
How do I fix CVE-2025-4427?
Upgrade EPMM to a patched version: 11.12.0.5, 12.3.0.2, 12.4.0.2, or later. Both CVE-2025-4427 and CVE-2025-4428 must be patched together to prevent the chained exploit. Restrict API access to trusted networks as an immediate mitigation.
How severe is CVE-2025-4427?
The standalone CVSS v3.1 base score is 5.3 (Medium), but the real-world severity is much higher due to its role as the authentication bypass component in an exploit chain with CVE-2025-4428 that enables unauthenticated RCE. The EPSS score of 90.79% at the 99th percentile confirms this is among the most actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.