Ivanti EPMM CVE-2025-10242

Requires an authenticated session with ADMIN privileges to the EPMM admin panel - this is the primary limiting factor (CVSS PR:H). The vulnerable code path is in the admin panel, so exploitation depends on the attacker first holding or compromising an administrator account; there is no user-interaction requirement (UI:N) and the interface is network-reachable (AV:N), so once admin access is held, exploitation is low-complexity against affected versions (before 12.6.0.2, 12.5.0.4, 12.4.0.4). This is not exploitable by an unauthenticated or low-privileged remote attacker on its own; realistic risk rises if chained with a separate authentication/privilege-escalation flaw or via credential compromise.

This is a genuine priority despite the moderate 7.2 CVSS, driven primarily by the exceptionally high EPSS score of 20.35% (97th percentile) - one of the strongest exploitation-probability signals in the dataset and far above the sub-1% norm for typical CVEs. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows network-reachable, low-complexity RCE but is gated behind PR:H (admin privileges), which is the single largest mitigating factor and the reason the score sits at 7.2 rather than critical. There is no CISA KEV listing and no POC referenced in the input, so per precision rules this is 'no public exploit identified at time of analysis'; however, the EPSS/percentile is elevated well beyond what POC-absence would normally predict, consistent with Ivanti EPMM's (formerly MobileIron Core) long track record as a repeatedly and actively exploited edge-MDM target. Net: the admin-auth requirement narrows the realistic attacker set, but the high EPSS plus vendor exploitation history means this should be patched promptly rather than deferred as a 'high-CVSS-low-real-risk' item. Note the signal tension: high EPSS but no KEV/POC in the provided data - verify current KEV status independently before final triage.

An attacker who has obtained EPMM admin-panel credentials (via phishing, credential reuse, a chained prior vulnerability, or a rogue/over-privileged insider) submits crafted input to an admin-panel function that passes it unsanitized to an OS shell, achieving remote code execution on the EPMM host. Because EPMM manages enrolled mobile fleets, this yields a pivot into device management, certificates, and potentially downstream corporate mobile infrastructure. No public POC is referenced in the provided data, but the elevated EPSS suggests exploitation tooling may emerge or already circulate.