Code Injection Vulnerability (CVE‑2025‑4428) in Ivanti Endpoint Manager Mobile Enables Authenticated Remote Code Execution
What It Is — Ivanti Endpoint Manager Mobile (EPMM) contains a code‑injection flaw in its API layer. An authenticated attacker can send specially‑crafted API requests that trigger arbitrary code execution on the server. The issue stems from an insecure use of the Hibernate Validator library (see CVE‑2025‑35036).
Exploitability — The vulnerability requires valid credentials, but no public exploit code has been released. CVSS has not yet been published; the technical details suggest a high impact if leveraged.
Affected Products — Ivanti Endpoint Manager Mobile (EPMM) – all versions prior to the vendor‑issued fix.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls and evidence that patches are applied promptly.
- Highlights gaps in secure development practices; organizations must prove they validate third‑party libraries and enforce code‑review policies.
- Authenticated abuse underscores the importance of access‑control monitoring and immutable logging to provide a defensible audit trail for regulators and enterprise buyers.
Recommended Actions
- Apply Ivanti’s security patch for CVE‑2025‑4428 immediately.
- Conduct a rapid code‑review of all API endpoints to verify proper input validation and library hardening.
- Strengthen authentication hygiene (least‑privilege accounts, MFA) and enable detailed API request logging.
- Update your vulnerability‑management process to capture evidence of remediation for audit purposes.
Source: CISA KEV – CVE‑2025‑4428