Ivanti EPMM RCE (CVE-2025-4428): one request, remote code on your MDM

What happened

On 13 May 2025, Ivanti disclosed two chained flaws in Endpoint Manager Mobile (EPMM, formerly MobileIron Core): CVE-2025-4427, an authentication bypass in the API component, and CVE-2025-4428, a remote code execution flaw in the same API layer. Per NVD, CVE-2025-4428 alone allows authenticated attackers to execute arbitrary code via crafted API requests — but chained with the CVE-2025-4427 auth bypass, the pair yields code execution with no credentials at all.

Ivanti's advisory (Security Advisory Ivanti Endpoint Manager Mobile EPMM) urged immediate patching, and the pair joined a long line of actively exploited Ivanti edge flaws that had already drawn CISA emergency directives in prior years. Both CVEs sit in CISA's KEV catalog.

Impact

EPMM manages the phones and tablets of the whole company — VPN profiles, certificates, mail configs. Code execution on the MDM means an attacker can push malicious profiles, harvest device certificates, and intercept corporate mail sync. Because the auth bypass removes the login barrier, an internet-facing appliance is one request away from full compromise. For retail and logistics fleets (warehouse scanners, POS tablets), a compromised MDM is a compromised fleet.

Root cause in one paragraph

An expression-injection flaw in the API layer evaluated attacker-controlled input as server-side code, and a companion authentication bypass in the same component meant the endpoint could be reached without credentials. Either flaw alone is serious; together they collapse the only barrier between the internet and code execution — knowing the request shape, which became public within hours.

What to do now

• Upgrade EPMM to the fixed builds named in Ivanti's EPMM security advisory (patched 12.5.x, 12.4.x, and 12.3.x lines) — covering both CVE-2025-4427 and CVE-2025-4428 in one pass.
• Never expose the EPMM admin/API port directly; front it with a VPN or allow-listed gateway.
• Review appliance logs for unauthenticated hits on the API paths named in the advisory.
• Re-enroll and rotate device certificates if the appliance was internet-facing while vulnerable.
• Track Ivanti advisories as a standing feed — EPMM, Connect Secure, and CSA have a repeated-exploitation history.

What this means for Magento stores

If your warehouse runs on MDM-managed scanners or your staff uses EPMM-enrolled phones for admin 2FA approvals, the MDM is part of your checkout's trust chain. Segment it: MDM traffic, store traffic, and ERP traffic belong on separate networks with separate credentials, so one appliance flaw cannot walk into the Magento database.

Sources

• NVD: CVE-2025-4428, CVE-2025-4427
• Ivanti EPMM security advisory, May 2025

Next in this series: Citrix Bleed 2 (CVE-2025-5777) — /blog/cve-2025-citrix-bleed2-5777