Do Son CISA has released a new report detailing how attackers are exploiting Ivanti EPMM flaws to deploy malicious listeners and gain remote code execution.
CVE-2025-4428
A critical zero-day (CVE-2025-4428) in Ivanti EPMM is exploited by UNC5221, enabling unauthenticated RCE and data theft across multiple sectors.
Ivanti fixes EPMM flaws CVE-2025-4427 and CVE-2025-4428, exploited in the wild for unauthenticated RCE. Update now or apply strict API access controls.