CVE-2025-10243

HIGH

Ivanti Endpoint Manager Mobile < 12.4.0.4 - OS Command Injection

Title source: rule

Description

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

References (1)

[Vendor Advisory] https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US

Scores

CVSS v3 7.2

EPSS 0.0374

EPSS Percentile 87.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-78

Status published

Affected Products (1)

ivanti/endpoint_manager_mobile < 12.4.0.4

Timeline

Published Oct 14, 2025

Tracked Since Feb 18, 2026