CVE-2025-4428· ivanti / endpoint manager mobile (epmm)· CWE-94
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Exploited in the wild. Listed by CISA on 2025-05-19; known to be used by ransomware.
88%likelihood of exploitation, next 30 days
100%of all CVEs are less likely
Nonecheck to confirm it
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as represented by CVE-2025-35036.
No ready check is stored for this CVE. Confirm it by hand from the references.
References
Use this check only on systems you are authorised to test. Where the data comes from