Endpoint manager mobile - RCE (CVE-2025-4428)

CVE-2025-4428 is a vulnerability affecting Ivanti Endpoint Manager Mobile, where attackers with access can achieve remote code execution by submitting crafted API requests to a specific endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 21st of May 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2025-4428 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-4428. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed attack patterns specifically target URLs containing /mifs/rs/api/v2/featureusage.