Ivanti EPMM Code Injection (CVE-2025-4428)

Historical catalog analysis: CISA added this entry on May 19, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-4428 is a code injection vulnerability (CWE-94) located within the API component of Ivanti Endpoint Manager Mobile (EPMM). The flaw originates from an insecure implementation of the Hibernate Validator open-source library, specifically referenced as CVE-2025-35036. This allows an authenticated attacker to execute arbitrary code remotely by sending crafted requests to the API.

Exposure and applicability

This vulnerability affects organizations deploying Ivanti EPMM. The attack vector requires authentication; however, once authenticated, the attacker can leverage the API component to achieve remote code execution (RCE). Because this involves a third-party library integrated into the product’s API, exposure is tied to any instance of EPMM utilizing the affected Hibernate Validator implementation.

Remediation priorities

Based on the reported vulnerability and its inclusion in CISA’s Known Exploited Vulnerabilities catalog, we analyze the following prioritization for defenders:

1. Immediate Patching/Mitigation: Priority should be given to applying vendor-supplied mitigations or updates as specified in Ivanti’s security advisory.
2. Cloud Service Review: For organizations utilizing EPMM via cloud services, review and apply guidance consistent with BOD 22-01 to ensure the service provider has addressed the exposure.
3. Decommissioning: In scenarios where vendor mitigations are unavailable or cannot be applied to a specific environment, the source suggests discontinuing use of the product to eliminate the risk.

How to validate remediation

Verification must go beyond a simple version check. To ensure that exposure has been reduced, vulnerability management teams should:
* Confirm Mitigation Application: Verify through vendor-specific documentation that the mitigation for CVE-2025-4428 (and the underlying Hibernate Validator issue) is active.
* API Access Audit: Review authenticated API access logs to identify any anomalous requests targeting the affected component prior to and after patching.
* Configuration Validation: Ensure that the specific API endpoints associated with the Hibernate Validator implementation are no longer susceptible to crafted injection attempts, following authorized vendor testing procedures.

Limits and open questions

While the vulnerability is documented as being exploitable by authenticated users, it remains unknown whether this flaw has been utilized in ransomware campaigns. Additionally, while CISA has established a remediation deadline for federal agencies, this date does not automatically apply to private sector organizations, though it serves as an indicator of urgency. Residual risk remains if authentication mechanisms are weak or if compromised credentials allow an attacker to reach the API component.

Source and editorial note

CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability · Source date: May 19, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 22, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 14, 2026 at 00:18 UTC.

Request a Vulnerability Assessment