PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild

wiz.io | vulnerability | #rce | #exploitation | #vulnerability | #ivanti | #epmm | #cve-2025-4427 | #cve-2025-4428
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz details in-the-wild exploitation of Ivanti EPMM: CVE-2025-4427 (auth bypass) plus CVE-2025-4428 (Java EL injection RCE) combine into unauthenticated RCE — despite CVSS scores of 5.3 and 7.2.
Published
Collected

Related coverage

vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · netspi.com
Ivanti Endpoint Manager Mobile (EPMM) [CVE-2026-1281 & CVE-2026-1340]: Overview & Takeaways
Ivanti EPMM has two actively exploited zero-day code injection flaws, CVE-2026-1281 and CVE-2026-1340, letting unauthenticated remote attackers compromise appliances and access sensitive data.
vulnerability · hacktron.ai
Hacktron finds another pre-auth RCE variant in Ivanti EPMM
Hacktron identified a new EL injection sink in Ivanti EPMM and used it to demonstrate yet another pre-authentication RCE variant in the mobile device management platform.
blog · netspi.com
Q1 2026 Critical Vulnerability Roundup: Mitigating Risk
A Q1 2026 roundup of top exploited criticals, including unauthenticated RCE in the Oracle WebLogic Server Proxy Plugin and an Ivanti EPMM auth bypass plus path traversal combo (CVE-2026-1281/1340).
Back