Loading story…
Researchers published a technical analysis of Ivanti Endpoint Manager Mobile (EPMM) flaws CVE-2025-4427 and CVE-2025-4428, describing a pre-authentication remote code execution path in the product and detailing how attacker-controlled input could reach vulnerable server-side processing. The disclosures focused on how exposed API functionality could be abused before authentication, raising concern for internet-facing EPMM deployments.
A follow-on variant analysis identified a similar pre-auth RCE condition in the /api/v2/policy/androidfirmware endpoint, where unsanitized input in Hibernate Validator error-message templates could trigger Expression Language injection before Spring Security authorization checks. The write-up traced the issue through AndroidFirmwarePolicyControllerV2, AndroidFirmwarePolicyRequest, and related validation logic for the deviceModel field in Zebra firmware selections, and demonstrated evaluation with a proof of concept that returned 9999 from ${3*3333}; the researchers later said the latest Ivanti version was not affected because of a Hibernate Validator upgrade.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Hacktron reported a newly identified pre-authentication remote code execution variant in Ivanti EPMM affecting the /api/v2/policy/androidfirmware endpoint and described a proof of concept using ${3*3333}. The write-up says the researchers first thought it was a 0-day and reported it to Ivanti, but later determined the latest version was not affected due to a Hibernate Validator upgrade.
ProjectDiscovery published a technical analysis of Ivanti Endpoint Manager Mobile remote code execution vulnerabilities CVE-2025-4427 and CVE-2025-4428. The reference anchors this publication on May 15, 2025.
Ivanti released security updates for CVE-2025-22462 in Neurons for ITSM and CVE-2025-4427/CVE-2025-4428 in Endpoint Manager Mobile, warning that the vulnerabilities were being actively exploited. The advisory said the two EPMM flaws could be chained for unauthenticated remote code execution and urged immediate patching and API access restrictions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
hacktron.ai
Open sourceprojectdiscovery.io
Open sourcecsirt.sk
Open sourcehelp.ivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, `CVE-2023-35078` and `CVE-2023-35081`, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. `CVE-2023-35078` is a critical authentication bypass affecting internet-facing API paths, while `CVE-2023-35081` is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment. Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted `CVE-2023-35078` as a critical API access flaw, while Ivanti later disclosed `CVE-2023-35082`, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious `mi.war` Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.
Jun 29, 2026
Ivanti issued emergency patches for two **critical zero-day** vulnerabilities in *Endpoint Manager Mobile (EPMM)*—**CVE-2026-1281** and **CVE-2026-1340**—described as code-injection flaws that can enable **pre-auth remote code execution**. Reporting indicates successful exploitation could allow attackers to run arbitrary code and potentially access sensitive device and user data managed by EPMM, elevating risk for organizations using the product for mobile device management. Technical discussion and community commentary amplified the disclosure, pointing to detailed research write-ups (including analysis focused on exploitation mechanics) and reinforcing the urgency of patching internet-exposed EPMM instances. Separate industry coverage during the same period also emphasized broader 2026 security priorities (AI-enabled social engineering, quantum-readiness, and general vulnerability management), but did not add incident-specific details about the Ivanti EPMM zero-days beyond the general call to improve patching discipline.
Jun 29, 2026
Ivanti released security updates for **Endpoint Manager Mobile (EPMM)** to fix two high-severity vulnerabilities, **`CVE-2026-6973`** and **`CVE-2026-10727`**, that could let an authenticated remote attacker achieve remote code execution and privilege escalation. Ivanti said `CVE-2026-6973` is a configuration control weakness that allows arbitrary Apache directive injection, while `CVE-2026-10727` is an OS command injection flaw that can result in command execution as **root**. The company said it was not aware of customer exploitation at the time of disclosure.
Jun 29, 2026