Ivanti EPMM Zero-Days: Reconnaissance to Exploitation
Summary: Two critical Ivanti zero-days, CVE-2025-4427 and CVE-2025-4428, are now being actively exploited, chained together to enable unauthenticated remote code execution on Ivanti Endpoint Manager Mobile systems. The flaws target the /api/v2/featureusage and /api/v2/featureusage_history endpoints, where input validation occurs before authentication checks, following a 9X surge in scanning against Ivanti products that GreyNoise reported in April.
Key Takeaway: That 9X reconnaissance surge has now turned into exploitation, and the activity is expected to accelerate as more threat actors add these vulnerabilities to their toolkits. Portal ACLs and WAF restrictions reduce exposure, but patching is the only complete fix.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-4427CVE-2025-4428
- Related
- CVE-2025-4427: Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 19, 2025CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Known Exploited Vulnerabilities · May 19, 2025New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026