CVE-2025-4427: 
Ivanti Endpoint Manager Mobile vulnerability analysis and mitigation

An authentication bypass vulnerability (CVE-2025-4427) was discovered in the API component of Ivanti Endpoint Manager Mobile (EPMM) 12.5.0.0 and prior versions. The vulnerability was reported by CERT-EU and disclosed on May 13, 2025. This security flaw affects the on-premises EPMM product, which is a mobile device management (MDM) and endpoint security solution for enterprises (Help Net Security, Tenable Blog).

CVE-2025-4427 is an authentication bypass vulnerability with a CVSS v3.1 score of 5.3 (Medium). The flaw allows unauthenticated, remote attackers to access the server's application programming interface (API) that is normally only accessible to authenticated users. The vulnerability is associated with open-source libraries integrated into EPMM, though the specific libraries have not been disclosed (Tenable Blog, Hacker News).

The vulnerability allows attackers to access protected resources without proper credentials via the API. The risk is significantly reduced for customers who filter access to the API using either the built-in Portal ACLs functionality or an external web application firewall. The vulnerability only affects the on-premises EPMM product and is not present in Ivanti Neurons for MDM, Ivanti's cloud-based unified endpoint management solution, Ivanti Sentry, or any other Ivanti products (Hacker News).

Ivanti has released patches for the affected versions: 11.12.0.5, 12.3.0.2, 12.4.0.2, and 12.5.0.1. Organizations can reduce their exposure by implementing API filtering through either the built-in Portal ACLs functionality or an external web application firewall. Users are strongly advised to update their instances to the latest versions for optimal protection (Tenable Blog).

The vulnerability has been flagged by CERT-EU, the cybersecurity service for the institutions, bodies, offices and agencies of the European Union, suggesting it likely affected some of these institutions. Ivanti is actively collaborating with security partners, the broader security community, and law enforcement regarding this vulnerability (Help Net Security).