DaystoPatch

IvantiExploited incident

Ivanti EPMM API authentication bypass chained with RCE (May 2025 zero-days)

CVE-2025-4427, CVE-2025-4428High, CVSS 7.2In CISA's Known Exploited Vulnerabilities catalog since 19 May 2025

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2025-4427 (CNA: Ivanti)CuratedQuote verified

    "datePublished":"2025-05-13T15:45:35.145Z"

    Ivanti's disclosure, which already said customers had been exploited, is the earliest public signal found. CERT-EU reported the bugs to Ivanti.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d630f6a668f3b7bb…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Help Net SecurityCuratedQuote verified13 May 2025

    Attackers have exploited vulnerabilities in open-source libraries to compromise on-prem Ivanti Endpoint Manager Mobile (EPMM) instances of a “very limited” number of customers, Ivanti has confirmed on Tuesday, and urged customers to install a patch as soon as possible.

    Article dated May 13, 2025.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:205b7a34d17e8516…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-4427ClaimedQuote verified13 May 2025, 15:45 UTC

    An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d630f6a668f3b7bb…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 May 2025, 16:30 UTC

    https://cve.threatint.eu/CVE/CVE-2025-4428?utm_campaign=info&utm;_medium=rss&utm;_source=website

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: greynoiseClaimedQuote verified16 May 2025

    Two critical Ivanti zero-days (CVE-2025-4427 and CVE-2025-4428) are now being actively exploited after a surge in scanning activity last month. When chained together, these vulnerabilities enable unauthenticated

    Earliest mention we hold (a vetted outlet).

    Source
    Research: greynoise research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1037703b81576029…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-4427)ClaimedQuote verified19 May 2025

    Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2025-05-19.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-4428)ClaimedQuote verified19 May 2025

    Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

    Added to CISA's KEV catalog on 2025-05-19.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet10 Aug 2025, 23:30 UTC

    📢 Exploitation active des failles Ivanti EPMM (CVE-2025-4427/4428) par UNC5221 détectée par Darktrace 📝 Selon Darktrace (billet de blog... 📖 cyberveille : https:// cyberveille.ch/posts/2025-08-1 0-exploitation-active-des

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2025-4427 (CNA: Ivanti)CuratedQuote verified

    "datePublished":"2025-05-13T15:45:35.145Z"

    CVE-2025-4428's record followed at 15:46:55Z. The advisory page itself is JavaScript-only.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d630f6a668f3b7bb…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Help Net SecurityCuratedQuote verified

    Ivanti has released EPMM versions with fixes – 11.12.0.5, 12.3.0.2, 12.4.0.2 , 12.5.0.1

    Fixed releases were published with the 2025-05-13 advisory.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:205b7a34d17e8516…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Help Net SecurityCuratedQuote verified

    Ivanti has released EPMM versions with fixes – 11.12.0.5, 12.3.0.2, 12.4.0.2 , 12.5.0.1

    One fixed release per supported line (11.12, 12.3, 12.4, 12.5) on the disclosure day.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:205b7a34d17e8516…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Ivanti Endpoint Manager Mobile (EPMM, on-premises)
How we built this timeline

Zero-day: Ivanti said a 'very limited' number of customers were exploited at disclosure; the flaws were in open-source libraries used by EPMM and were reported by CERT-EU. Chained, CVE-2025-4427 (auth bypass, CVSS 5.3) and CVE-2025-4428 (authenticated RCE, CVSS 7.2) give unauthenticated RCE; severity uses the higher vendor score (7.2, high), although the chain is effectively critical.

Primary CVE is the one the advisory title leads with. KEV 19 May 2025 for both.

Ivanti's May 2025 blog post could not be located at a guessed URL, and the advisory page is JavaScript-only, so vendor statements are cited via the CVE records and Help Net Security. R1 check (23 Oct 2026): the matches for 'bypass' are the vulnerability's own description (authentication bypass); no source describes the May 2025 releases as an incomplete fix.

Related

Ivanti report card