CVE-2025-10985

published 2025-10-14

CVE-2025-10985: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin…

Priority P2 64 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ivanti	endpoint_manager_mobile	< 12.4.0.4	12.4.0.4
ivanti	endpoint_manager_mobile	>= 12.5.0.0 < 12.5.0.4	12.5.0.4
ivanti	endpoint_manager_mobile	>= 12.6.0.0 < 12.6.0.2	12.6.0.2

Detection & IOCs extracted from sources · hover to see the quote

• → Vulnerability class is OS command injection (CWE-78) in the Ivanti EPMM admin panel; monitor for anomalous OS command execution originating from the EPMM admin interface process ↗
• → Restrict and audit admin panel access to Ivanti EPMM; alert on authenticated admin sessions performing unexpected shell/command execution ↗

• · Vulnerability affects Ivanti EPMM versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4; ensure patched versions are deployed to remediate ↗
• · Exploitation requires remote authenticated attacker with admin privileges; enforce least-privilege and MFA on admin accounts to reduce attack surface ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78