Is CVE-2025-4427 being actively exploited?

Yes. CVE-2025-4427 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on May 19, 2025.

What is the CVSS score for CVE-2025-4427?

CVE-2025-4427 has a CVSS 3.1 base score of 5.3 (MEDIUM).

CVE-2025-4427

MEDIUM · CVSS 5.3CISA KEV: actively exploitedEPSS 99.9%EU EUVD: exploited

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

Key facts

CVSS score: 5.3 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-288
EPSS score: 99.9% (100th percentile)
In CISA KEV: Yes, added May 19, 2025
In EU EUVD: Yes (EUVD-2025-14388)
Published: May 13, 2025
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability

Added to the KEV catalog on May 19, 2025; federal remediation due June 9, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-14388 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

ivanti / endpoint manager mobile
ivanti / endpoint manager mobile

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Ivanti Endpoint Manager Mobile (EPMM) System 12 - Ivanti, Inc. - Common Criteria CCEVS-VR-VID-11566-2025 - active

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4427(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain