CVE-2025-10243

published 2025-10-14

CVE-2025-10243: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin…

Priority P2 64 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ivanti	endpoint_manager_mobile	< 12.4.0.4	12.4.0.4
ivanti	endpoint_manager_mobile	>= 12.5.0.0 < 12.5.0.4	12.5.0.4
ivanti	endpoint_manager_mobile	>= 12.6.0.0 < 12.6.0.2	12.6.0.2

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerability class is OS command injection (CWE-78) in the Ivanti EPMM admin panel — monitor for anomalous OS command execution originating from the EPMM admin interface process ↗
• → Exploitation requires an authenticated session with admin privileges — alert on unexpected admin-level API calls or admin panel interactions followed by child process spawning from the EPMM service ↗

• · Affected versions are Ivanti EPMM before 12.6.0.2, 12.5.0.4, and 12.4.0.4 — verify deployed version against these thresholds to confirm exposure ↗
• · Attack vector is network-based but requires admin authentication — reducing or auditing admin panel exposure and enforcing MFA on admin accounts limits the exploitable attack surface ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78