Ivanti’s Enterprise Mobility Manager Under Siege as Zero-Day Vulnerabilities Trigger Widespread Exploitation Campaign

Enterprise security teams are scrambling to patch critical vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) software after researchers discovered active exploitation attempts targeting the widely-used mobile device management platform. The flaws, disclosed in late January 2025, have already prompted emergency advisories from federal cybersecurity agencies and raised concerns about the security posture of organizations managing mobile device fleets.

According to Cybersecurity Dive , Ivanti revealed two critical vulnerabilities—CVE-2025-0282 and CVE-2024-11639—that affect multiple versions of its EPMM platform. The first vulnerability, CVE-2025-0282, carries a CVSS score of 9.0 and allows unauthenticated remote code execution through SQL injection. The second flaw, CVE-2024-11639, scored at 7.0, enables authentication bypass that could grant attackers administrative access to vulnerable systems.

The timing of these discoveries has proven particularly problematic for enterprises already stretched thin by ongoing security challenges. Ivanti, a company that has faced scrutiny over previous security incidents, now finds itself managing another crisis that threatens thousands of organizations relying on its mobile management solutions. The company has released patches for EPMM versions 12.4.0.1 and 12.5.0.0, urging customers to implement updates immediately.

Federal Agencies Sound the Alarm on Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) moved swiftly to add both vulnerabilities to its Known Exploited Vulnerabilities catalog, a designation reserved for flaws with confirmed active exploitation in the wild. This action mandates that federal civilian agencies patch affected systems within strict deadlines, typically 21 days from the catalog addition date. The urgency reflects intelligence suggesting threat actors have already begun weaponizing these vulnerabilities for malicious purposes.

Security researchers have observed reconnaissance activity and exploitation attempts targeting internet-facing EPMM instances within hours of the vulnerability disclosure. The speed at which attackers mobilized suggests either prior knowledge of the flaws or highly sophisticated capabilities to reverse-engineer patches and develop exploits. Organizations with public-facing EPMM deployments face the highest risk, as these systems provide attackers with direct access to attempt exploitation without first compromising internal networks.

Technical Analysis Reveals Sophisticated Attack Vectors

The SQL injection vulnerability in CVE-2025-0282 represents a particularly dangerous attack vector because it requires no authentication to exploit. Attackers can craft malicious SQL queries through vulnerable input fields, potentially extracting sensitive data, modifying database contents, or executing arbitrary code on the underlying server. For mobile device management platforms that store extensive employee information, device configurations, and corporate credentials, such access could prove catastrophic.

CVE-2024-11639’s authentication bypass mechanism allows attackers to circumvent normal login procedures and gain administrative privileges. Once inside with elevated access, threat actors could push malicious configurations to managed devices, steal corporate data synchronized through the platform, or establish persistent access for long-term espionage operations. The combination of these two vulnerabilities creates multiple pathways for attackers to compromise not just the EPMM infrastructure but potentially the entire mobile device fleet under management.

Ivanti’s Troubled Security History Compounds Current Crisis

This latest security incident adds to a troubling pattern for Ivanti, which has weathered multiple high-profile vulnerability disclosures over the past two years. In 2024, the company faced criticism over flaws in its Connect Secure VPN appliances that were exploited by sophisticated threat actors, including suspected nation-state groups. Those incidents resulted in widespread compromises and forced emergency patching campaigns across thousands of organizations.

The recurring nature of critical vulnerabilities in Ivanti products has prompted some security experts to question the company’s secure development practices and code review processes. While no software vendor can guarantee zero vulnerabilities, the frequency and severity of flaws discovered in Ivanti products have raised eyebrows within the cybersecurity community. Organizations now face difficult decisions about whether to continue relying on Ivanti solutions or invest in alternative platforms with potentially stronger security track records.

Enterprise Response and Mitigation Strategies

Security teams managing EPMM deployments face immediate pressure to assess their exposure and implement protective measures. For organizations unable to patch immediately, Ivanti has recommended several temporary mitigations, including restricting network access to EPMM servers through firewall rules and implementing additional authentication controls. However, security experts caution that such workarounds provide only limited protection against determined attackers.

The patching process itself presents challenges for many organizations. EPMM typically requires careful planning and testing before updates, as the platform manages critical mobile device infrastructure that employees depend on for daily operations. Rushed patching could potentially disrupt mobile device management capabilities, leaving organizations caught between the risk of exploitation and the risk of operational disruption. This dilemma underscores the importance of robust patch management processes and the ability to rapidly deploy emergency updates when necessary.

Broader Implications for Mobile Device Management Security

The Ivanti EPMM vulnerabilities highlight systemic challenges in securing mobile device management platforms, which have become critical infrastructure for modern enterprises. As organizations increasingly adopt bring-your-own-device policies and remote work arrangements, MDM platforms control access to sensitive corporate resources and data. Compromising these systems provides attackers with extraordinary leverage, potentially affecting thousands of devices and users through a single successful breach.

The incident also demonstrates how quickly threat actors can pivot to exploit newly disclosed vulnerabilities. The window between public disclosure and active exploitation has compressed dramatically in recent years, leaving organizations with minimal time to respond. This dynamic favors attackers with advanced capabilities and infrastructure ready to rapidly develop and deploy exploits, while defenders must navigate complex patching processes across diverse environments.

Industry Reactions and Vendor Accountability

Cybersecurity vendors and researchers have called for greater accountability from software providers, particularly those offering security-critical infrastructure products. The National Security Agency and other government agencies have advocated for secure-by-design principles that would require vendors to implement robust security controls during development rather than addressing vulnerabilities reactively after exploitation occurs.

Some industry observers argue that vendors like Ivanti should face stronger consequences for repeated security failures, potentially including liability provisions or regulatory penalties. However, the complex legal framework governing software liability and the challenges of attributing security incidents make such accountability difficult to enforce. Organizations ultimately bear the responsibility for managing their own risk, even when using third-party products with known security issues.

Looking Ahead: Lessons for Enterprise Security Programs

The Ivanti EPMM incident reinforces several critical lessons for enterprise security programs. First, organizations must maintain comprehensive asset inventories that enable rapid identification of affected systems when new vulnerabilities emerge. Many enterprises struggle to quickly determine their exposure to newly disclosed flaws, delaying response efforts and extending the window of vulnerability.

Second, security teams need robust patch management capabilities that can accommodate emergency updates without disrupting critical operations. This requires not just technical infrastructure but also organizational processes, executive support, and communication channels that enable rapid decision-making during security crises. Organizations that excel at these capabilities demonstrate significantly better resilience when facing zero-day threats and fast-moving exploitation campaigns.

Finally, enterprises should regularly reassess vendor relationships and maintain contingency plans for replacing critical infrastructure components if vendors demonstrate persistent security weaknesses. While switching vendors involves significant costs and complexity, the risks of remaining dependent on products with repeated security failures may ultimately outweigh the challenges of migration. As mobile device management becomes increasingly central to enterprise operations, ensuring the security and reliability of these platforms must remain a top priority for security leaders and executives alike.