Ivanti EPMM RCE and auth bypass vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in Ivanti Endpoint Manager Mobile enable remote code execution; limited exploitation reported at disclosure.
Ivanti Endpoint Manager Mobile (EPMM) contains multiple vulnerabilities that could allow remote code execution. The most critical flaw (CVE-2025-4428) enables arbitrary code execution on affected systems, with an authentication bypass vulnerability (CVE-2025-4427) that can facilitate exploitation of the RCE. Successful exploitation grants an attacker the ability to install programs, view, change, or delete data depending on system privileges.
Affected versions include EPMM 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior. According to Ivanti and CIS, a limited number of customer environments had been exploited at the time of this advisory's disclosure. The vulnerabilities are exploitable remotely via public-facing interfaces, making this a direct risk to organizations running vulnerable versions of EPMM in production.
Mentioned in this report
Detection guidance
Ivanti EPMM Legacy API Request With Expression Language or Java Injection Payload
Web requests to the EPMM /mifs/rs/api/v2/ endpoints whose query string carries Java EL (${...}) or Runtime/ProcessBuilder payloads, matching the CVE-2025-4427/4428 auth bypass and RCE chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti EPMM Legacy API Request With Expression Language or Java Injection Payload
id: 722b605f-66f1-510a-a1ee-5309c4bccb21
status: experimental
description: Detects requests to Ivanti EPMM /mifs/rs/api/v2/ API paths whose query
string contains Java Expression Language or Java runtime execution markers (plain
or URL-encoded). This pattern is associated with exploitation of CVE-2025-4427 and
CVE-2025-4428. It generalises on the endpoint and injection syntax rather than any
specific payload or source address.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-mobile-could-allow-for-remote-code-execution_2025-051
tags:
- attack.initial-access
- attack.t1190
- cve.2025-4427
- cve.2025-4428
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains: /mifs/rs/api/v2/
selection_payload:
cs-uri-query|contains:
- ${
- '%24%7B'
- '%24{'
- java.lang.Runtime
- ProcessBuilder
- getRuntime
condition: selection_path and selection_payload
falsepositives:
- Authorised vulnerability scanners or penetration tests probing EPMM endpoints
level: high
author: Vorant
Java Application Server Spawning Shell With Download or Reverse Shell Commands on Linux
A Java/Tomcat parent process (as used by Ivanti EPMM) spawning a shell that runs download, reverse-shell or staging commands, which is post-exploitation of an RCE in a public-facing Java app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Application Server Spawning Shell With Download or Reverse Shell Commands
on Linux
id: b0d68bb5-79a3-5e48-ad61-f105d6b52150
status: experimental
description: Detects a Java process (for example the Tomcat instance behind Ivanti
EPMM) spawning a shell whose command line downloads content, opens a reverse shell
or stages a payload in a temp directory. This is typical post-exploitation behaviour
after RCE in a public-facing Java application such as CVE-2025-4428.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-mobile-could-allow-for-remote-code-execution_2025-051
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- nc -e
- base64 -d
- chmod +x
- /tmp/
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based deployment or backup scripts that call curl or wget through a shell
- Application update routines that stage files under /tmp
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-mobile-could-allow-for-remote-code-execution_2025-051
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs