CVE-2025-4428

Ivanti · Published May 13, 2025

8.8

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

Affected Products

Endpoint Manager Mobile < 11.12.0.5
Endpoint Manager Mobile < 12.3.0.2
Endpoint Manager Mobile < 12.4.0.2
Endpoint Manager Mobile

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H