Download the latest Vulnerability & Exploitation Report

Download now

CrowdSec

VulnTracking
CVE-2025-4427

Ivanti EPMM Authentication Bypass (CVE-2025-4427): A “Medium” Flaw From 2025 That Scanners Still Sweep By the Hundreds

CVE-2025-4427 is a CVSS 5.3 authentication bypass in Ivanti Endpoint Manager Mobile (EPMM) 12.5.0.0 and earlier. Chained with CVE-2025-4428, it gives an unauthenticated attacker code execution on the server. CrowdSec has observed 865 unique IP addresses sending requests matching this pattern since May 22, 2025. Upgrade EPMM; until then, block internet access to its /api/v2/ routes.

CVE-2025-4427

CVE-2025-4427 at a glance

  • Affected: Ivanti EPMM 11.12.0.4 and earlier, 12.3.0.1 and earlier, 12.4.0.1 and earlier, 12.5.0.0 and earlier
  • Fixed in: 11.12.0.5, 12.3.0.2, 12.4.0.2 and 12.5.0.1 (May 13, 2025), Ivanti security advisory
  • Vulnerability class: Authentication bypass using an alternate path (CWE-288)
  • Severity: CVSS 5.3 Medium on its own; chained with CVE-2025-4428 (CVSS 7.2), unauthenticated remote code execution
  • Authentication required: None
  • Public exploit: Yes. watchTowr published the full chain on May 15, 2025, and ProjectDiscovery released a detection template the same week.
  • CISA KEV: Added May 19, 2025, together with CVE-2025-4428
  • CrowdSec detection rule live since: May 21, 2025
  • First exploitation attempt observed: May 15, 2025, in the wild, per EclecticIQ. CrowdSec’s first observation: May 22, 2025
  • Exploitation phase: Background Noise (since September 16, 2026, after three days of Active Exploitation from September 13)
  • Observation window used here: June 24 to September 20, 2026 (89 days) for signal counts. Unique-IP counts and target profiles come from the Live Exploit Tracker as of September 21, 2026.

Key findings

  • Exploited within two days of disclosure: Ivanti disclosed CVE-2025-4427 on May 13, 2025. watchTowr published a working chain on May 15. EclecticIQ traced intrusions by a China-nexus espionage group to the same day, and CISA listed both CVEs on May 19. CrowdSec’s detection rule went live on May 21 and caught its first attempt on May 22. Any EPMM server that was online and unpatched in mid-May 2025 should be treated as possibly compromised.
  • 3,978 signals in 89 days, 16 months after the patch: Between June 24 and September 20, 2026, the CrowdSec Network recorded 3,978 signals matching the CVE-2025-4427 pattern, an average of 45 a day. The typical day is quieter (median 26), and the monthly median fell from 39 in July to 11 in September.
  • Two one-day sweeps, 27% of the volume: On August 26 and September 11, 2026, the number of distinct sources jumped from a usual 11 to 258 and 371. On both days, more than 90% of signals came from US addresses, and most of the targets were in Germany. The September sweep pushed the Live Exploit Tracker to Active Exploitation on September 13; three days later it was back to Background Noise.
  • Most targets are not EPMM customers: The Live Exploit Tracker classifies 68% of targeted machines as small office or home office (SOHO). Home servers do not run an enterprise mobile-management platform. This is scanning that tries every exposed web server in case one of them is EPMM.

What is Ivanti EPMM, and who is exposed to CVE-2025-4427?

Ivanti Endpoint Manager Mobile, formerly MobileIron Core, is the server IT teams use to manage company phones and tablets: enrolment, security policies, app distribution, remote wipe. It usually sits at the edge of the network because employees’ devices must reach it from anywhere, and it is typically connected to the company directory.

Why CVE-2025-4427 matters: Code execution on EPMM gives an attacker the device database and the keys it stores. In the 2025 intrusions, EclecticIQ saw attackers take phone numbers, IMEIs, and device locations, LDAP credentials, and Microsoft 365 access tokens. Victims included healthcare, telecoms, local government, and aviation organizations in Europe, North America, and Asia-Pacific.

How does CVE-2025-4427 work?

The flaw sits in EPMM’s API route /mifs/rs/api/v2/featureusage. EPMM checks the request’s format parameter before it checks who is asking, so an anonymous request reaches code that should be reserved for logged-in administrators. That is CVE-2025-4427. CVE-2025-4428 is what the attacker does next: the invalid format value is copied into an error message that Java evaluates as an expression, so a crafted value runs system commands. The root cause is an order-of-operations mistake, which watchTowr summarized as validation running before authentication.

  • Analyzed by Sonny and Piotr Bazydło at watchTowr Labs; in-the-wild payloads (Sliver backdoors, web shells, database dumps) documented by Wiz
  • Vendor advisory: Ivanti EPMM security advisory · Fix: EPMM 11.12.0.5, 12.3.0.2, 12.4.0.2, 12.5.0.1

EPMM keeps coming back in our alerts. MobileIron Core had two unauthenticated API flaws in 2023 (CVE-2023-35078 and CVE-2023-35082), and in February 2026 we covered CVE-2026-1281, another pre-authentication RCE. Three rounds of emergency patching in three years is a reason to ask whether this server needs to face the internet at all.

What is the CrowdSec Network observing for CVE-2025-4427?

Between June 24 and September 20, 2026, the CrowdSec Network recorded 3,978 signals from machines reporting requests that match the CVE-2025-4427 exploitation pattern. That averages 45 signals per day, peaking at 556 on September 11, 2026, when 371 distinct sources were active. Since CrowdSec’s first observation on May 22, 2025, the Live Exploit Tracker has counted 865 unique IP addresses, and CrowdSec CTI classifies 96% of the observed intent as infrastructure takeover.

By signal volume, 69% of sources were in the United States, 14% in Germany, and Egypt, Singapore, and Bulgaria about 3% each. Targets were in the United States (30%), Germany (27%), France (8%), and the Netherlands (8%). This describes where CrowdSec has visibility, not where EPMM is deployed.

The part worth flagging is the shape of the traffic. Most days, around 11 sources send a few dozen requests. Twice, on August 26 and September 11, several hundred US addresses appeared for one day, sprayed mostly German targets, and went quiet again. Earlier spikes looked different: on July 9, 17 sources sent 271 signals, 164 of them to Austria. Short, wide sweeps across unrelated targets are what you see when a CVE sits in a scanning toolkit’s standard checklist, not when someone is hunting one company. CVE-2025-4427 is now background noise, which is exactly why a forgotten EPMM server will be found.

What this data does not show

  • A matching request is an exploitation attempt. CrowdSec cannot confirm any of them succeeded, and a patched EPMM server is not affected.
  • 865 unique IP addresses are not 865 threat actors. One operator can rent hundreds of cloud addresses for a single sweep.
  • These counts come from traffic reaching machines participating in the CrowdSec Network: a sample, not a census.
  • The signal counts cover June to September 2026 only. CrowdSec’s first observation on May 22, 2025 came a week after the first known intrusions, so this data says nothing about May 13 to 21, 2025, when most of the real damage was done.
  • A probe of /mifs/rs/api/v2/featureusage looks the same whether it is checking for the flaw or exploiting it, so scans and attacks are counted together.

What defenders get wrong about CVE-2025-4427

The first mistake is letting the score set the priority. On its own, CVE-2025-4427 is a 5.3, and a patch queue sorted by CVSS puts it below dozens of “critical” items. But nobody exploits it on its own: it is the unlocked door in front of CVE-2025-4428, and the pair was used for espionage within 48 hours of disclosure. Rate the chain, not the parts.

The second is assuming a 2025 patch closed the case. If your EPMM was reachable between May 13 and the day you upgraded, the upgrade removed the flaw but not whatever was installed through it. Wiz and EclecticIQ found web shells under /mi/tomcat/webapps/mifs/, Sliver implants, and dumped LDAP tables. Hunt for those, then rotate the LDAP service account, the Microsoft 365 connector tokens, and the admin passwords EPMM holds.

The third is aiming for 12.5.0.1 today. Those versions fix CVE-2025-4427 but not the 2026 flaws. Move to Ivanti’s current supported release, and put the admin portal and API behind a VPN or an allow-list. Blocking at the edge buys time; it does not replace either step.

How do you protect Ivanti EPMM against CVE-2025-4427?

Patch. Upgrade EPMM to 11.12.0.5, 12.3.0.2, 12.4.0.2, 12.5.0.1 or later, and preferably to the current release that also covers CVE-2026-1281 (Ivanti advisory). Confirm the version in the admin portal, then send an unauthenticated request to /mifs/rs/api/v2/featureusage from outside your network: a patched server asks for credentials instead of returning a validation error.

Virtual patching with CrowdSec AppSec. There is no CVE-specific virtual patch for CVE-2025-4427 on the CrowdSec Hub as of September 21, 2026. The CrowdSec AppSec Component with the blocking OWASP Core Rule Set inspects requests before they reach EPMM, and its Java-injection rules target the kind of java.lang.Runtime payloads published for this chain. Test it against your EPMM traffic before relying on it.

sudo cscli collections install crowdsecurity/appsec-crs-inband
sudo systemctl reload crowdsec
sudo cscli appsec-rules list | grep -i crs

A blocked attempt returns HTTP 403 from the remediation component and shows up in cscli alerts list. Ivanti’s own interim advice is simpler and stronger: filter access to /rs/api/v2/* and /mifs/rs/api/v2/* with the portal ACL or an upstream firewall.

Preemptive blocking. Subscribe to the CrowdSec Intelligence Blocklists to drop addresses already flagged across the network. This covers infrastructure that has been seen before; a source appearing for the first time in a one-day sweep will get through.

Stay proactive. Follow CVE-2025-4427 on the Live Exploit Tracker and query its sources in CrowdSec CTI.

Unsure where to start? Begin with our 3-minute introduction track: https://start.crowdsec.net

Frequently asked questions about CVE-2025-4427

Is CVE-2025-4427 being exploited in the wild? Yes. Exploitation began on May 15, 2025, and CISA added it to KEV on May 19, 2025. CrowdSec first observed it on May 22, 2025, and has counted 865 unique IP addresses since, with 3,978 matching signals between June 24 and September 20, 2026.

Which versions of Ivanti EPMM are affected by CVE-2025-4427? 11.12.0.4, 12.3.0.1, 12.4.0.1, 12.5.0.0, and every earlier release in those branches. The first fixed releases are 11.12.0.5, 12.3.0.2, 12.4.0.2, and 12.5.0.1.

Can I mitigate CVE-2025-4427 without upgrading? Partly. Restricting access to the /api/v2/ routes blocks the known chain, and a WAF can filter the published payloads. Neither removes the flaw or cleans up a server that was already compromised.

Related CrowdSec Threat Alerts

Written by Kevin Kadosh, Core Team Developer, CrowdSec. Threat data reviewed by Matthieu Mazzolini, Data Team Lead. Published September 21, 2026.

Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.

If you’re already subscribed, feel free to like and share this post to help your network stay informed about current threats.

WRITTEN BY