Malicious Listener for Ivanti Endpoint Mobile Management Systems

Malicious Listener for Ivanti Endpoint Mobile Management Systems ↗ source

September 18, 2025 CISA Analysis Report

Source: https://www.cisa.gov/news-events/analysis-reports/ar25-261a

Summary

sets of malware from an organization compromised by cyber threat actors exploiting CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (Ivanti EPMM). Each set contains loaders for malicious listeners that enable cyber threat actors to run arbitrary code on the compromised server. Ivanti EPMM, versions 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 Affected Products and prior, and 12.5.0.0 and prior. (Ivanti provided a patch and disclosed the vulnerabilities on May 13, 2025.) ▪ Detect activity by using the indicators of compromise (IOCs) and

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-4428	7.2 High	Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely …
CVE-2025-4427	5.3 Medium	Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protecte…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Apache 40 KEV Ivanti 35 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.