Historical catalog analysis: CISA added this entry on May 19, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-4428 is a code injection vulnerability located within the API component of Ivanti Endpoint Manager Mobile (EPMM). The flaw stems from an insecure implementation of the Hibernate Validator open-source library (referenced as CVE-2025-35036). If exploited, an authenticated attacker could send crafted API requests to remotely execute arbitrary code on the management infrastructure.
Exposure and applicability
This vulnerability is applicable to healthcare organizations utilizing Ivanti EPMM to manage mobile endpoints. Because MDM (Mobile Device Management) solutions often oversee devices that access electronic Protected Health Information (ePHI), a compromise of the management server could provide an attacker with significant leverage over the mobile fleet. It is important to note that this specific vulnerability requires the attacker to be authenticated; it does not allow for unauthenticated remote access.
Remediation priorities
Based on our analysis, healthcare security leaders and clinical engineering teams should prioritize the following actions to reduce risk:
- Apply Vendor Mitigations: The primary priority is to implement the mitigations provided by Ivanti. This addresses the root cause within the API component.
- Review Authenticated Access: Since the attack vector requires authentication, organizations should review and audit accounts with API access to ensure the principle of least privilege is applied, potentially reducing the number of entities capable of initiating a crafted request.
- Evaluate Product Viability: In scenarios where mitigations cannot be applied or are unavailable for specific legacy environments, organizations should evaluate whether to discontinue use of the product to eliminate the risk of remote code execution.
How to validate remediation
To verify that exposure has been reduced, administrators should:
* Confirm Versioning/Patch Status: Verify through the management console or vendor tools that the recommended mitigations or updates have been successfully applied to the EPMM infrastructure.
* Audit API Logs: Review API access logs for unusual patterns of requests originating from authenticated accounts, which may indicate attempts to probe the vulnerability.
Note: Version checks alone do not guarantee security, as they only confirm a patch was applied, not that the system is free of other configuration weaknesses.
Limits and open questions
At this time, it is unknown whether this vulnerability has been leveraged by ransomware campaigns. Additionally, while CISA has established a remediation deadline of June 9, 2025, for federal agencies, this date serves as a risk benchmark rather than a legal requirement for private healthcare providers. There remains a residual risk that other vulnerabilities in the underlying open-source libraries may exist beyond those addressed by this specific update.
Source and editorial note
CVE-2025-4428: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability · Source date: May 19, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: May 22, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 11, 2026 at 00:39 UTC.
Request a healthcare security assessment
Turn healthcare security intelligence into action.
Discuss your environment, priorities, and the evidence needed to validate safeguards.
Request a healthcare assessment ↗