Ivanti EPMM Auth Bypass + Expression Language Injection RCE
- Product
- Ivanti Endpoint Manager Mobile
- CVE
- CVE-2025-4427CVE-2025-4428
- Disclosed
- 2025-05-13
- CVSS
- 8.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Ivanti EPMM 11.12.0.4 and earlier, 12.3.0.1 and earlier, 12.4.0.1 and earlier, 12.5.0.0 and earlier.
- Fixed
- 11.12.0.5, 12.3.0.2, 12.4.0.2, 12.5.0.1.
Summary
Two bugs in Ivanti EPMM, an authentication bypass and an expression-language code injection, chained to unauthenticated remote code execution. Exploitation by China-nexus actors began within days of the advisory.
Root cause
Both issues live in third-party/open-source libraries integrated into EPMM. A request parameter is reflected into a Java bean validation error message, which is evaluated as a template expression (EL injection). Validation runs before the authorization check on the affected routes, so unauthenticated requests reach the injection.
Impact
Unauthenticated code execution on the MDM server and control over enrolled devices.
Detection
Search access logs for requests to /api/v2/featureusage with expression syntax in the 'format' parameter; version-check against fixed builds.
Mitigation
Upgrade; restrict API access via the portal ACL as a temporary workaround.