# Ivanti EPMM RCE and auth bypass vulnerabilities

Published: 2026-06-09 · Severity: high · Sectors: government-national, technology
Canonical: https://vorant.io/reports/d4bb8703-0455-5315-b014-00d1f61e2ec5/ivanti-epmm-rce-and-auth-bypass-vulnerabilities

> Multiple vulnerabilities in Ivanti Endpoint Manager Mobile enable remote code execution; limited exploitation reported at disclosure.

Ivanti Endpoint Manager Mobile (EPMM) contains multiple vulnerabilities that could allow remote code execution. The most critical flaw (CVE-2025-4428) enables arbitrary code execution on affected systems, with an authentication bypass vulnerability (CVE-2025-4427) that can facilitate exploitation of the RCE. Successful exploitation grants an attacker the ability to install programs, view, change, or delete data depending on system privileges.

Affected versions include EPMM 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior. According to Ivanti and CIS, a limited number of customer environments had been exploited at the time of this advisory's disclosure. The vulnerabilities are exploitable remotely via public-facing interfaces, making this a direct risk to organizations running vulnerable versions of EPMM in production.

## Mentioned in this report

- Vulnerabilities: CVE-2025-4427 (KEV), CVE-2025-4428 (KEV)

## Detection guidance (public sample)

### Ivanti EPMM Legacy API Request With Expression Language or Java Injection Payload

ATT&CK: T1190

Web requests to the EPMM /mifs/rs/api/v2/ endpoints whose query string carries Java EL (${...}) or Runtime/ProcessBuilder payloads, matching the CVE-2025-4427/4428 auth bypass and RCE chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ivanti EPMM Legacy API Request With Expression Language or Java Injection Payload
id: 722b605f-66f1-510a-a1ee-5309c4bccb21
status: experimental
description: Detects requests to Ivanti EPMM /mifs/rs/api/v2/ API paths whose query
  string contains Java Expression Language or Java runtime execution markers (plain
  or URL-encoded). This pattern is associated with exploitation of CVE-2025-4427 and
  CVE-2025-4428. It generalises on the endpoint and injection syntax rather than any
  specific payload or source address.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-mobile-could-allow-for-remote-code-execution_2025-051
tags:
- attack.initial-access
- attack.t1190
- cve.2025-4427
- cve.2025-4428
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: /mifs/rs/api/v2/
  selection_payload:
    cs-uri-query|contains:
    - ${
    - '%24%7B'
    - '%24{'
    - java.lang.Runtime
    - ProcessBuilder
    - getRuntime
  condition: selection_path and selection_payload
falsepositives:
- Authorised vulnerability scanners or penetration tests probing EPMM endpoints
level: high
author: Vorant
```

### Java Application Server Spawning Shell With Download or Reverse Shell Commands on Linux

ATT&CK: T1190

A Java/Tomcat parent process (as used by Ivanti EPMM) spawning a shell that runs download, reverse-shell or staging commands, which is post-exploitation of an RCE in a public-facing Java app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Application Server Spawning Shell With Download or Reverse Shell Commands
  on Linux
id: b0d68bb5-79a3-5e48-ad61-f105d6b52150
status: experimental
description: Detects a Java process (for example the Tomcat instance behind Ivanti
  EPMM) spawning a shell whose command line downloads content, opens a reverse shell
  or stages a payload in a temp directory. This is typical post-exploitation behaviour
  after RCE in a public-facing Java application such as CVE-2025-4428.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-mobile-could-allow-for-remote-code-execution_2025-051
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - nc -e
    - base64 -d
    - chmod +x
    - /tmp/
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based deployment or backup scripts that call curl or wget through a shell
- Application update routines that stage files under /tmp
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-mobile-could-allow-for-remote-code-execution_2025-051

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d4bb8703-0455-5315-b014-00d1f61e2ec5/ivanti-epmm-rce-and-auth-bypass-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup