Is CVE-2025-4428 being actively exploited?

Yes. CVE-2025-4428 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on May 19, 2025.

What is the CVSS score for CVE-2025-4428?

CVE-2025-4428 has a CVSS 3.1 base score of 7.2 (HIGH).

CVE-2025-4428

HIGH · CVSS 7.2CISA KEV: actively exploitedEPSS 87.0%EU EUVD: exploited

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

Key facts

CVSS score: 7.2 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94
EPSS score: 87.0% (100th percentile)
In CISA KEV: Yes, added May 19, 2025
In EU EUVD: Yes (EUVD-2025-14387)
Published: May 13, 2025
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Added to the KEV catalog on May 19, 2025; federal remediation due June 9, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-14387 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

ivanti / endpoint manager mobile
ivanti / endpoint manager mobile

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Ivanti Endpoint Manager Mobile (EPMM) System 12 - Ivanti, Inc. - Common Criteria CCEVS-VR-VID-11566-2025 - active

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4428(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain