Ivanti EPMM CVE-2025-10243

Exploitation requires an authenticated session with administrator privileges on the Ivanti EPMM admin panel (CVSS PR:H) - this is the primary limiting factor and means the attacker must first obtain or compromise admin credentials, so it is not exploitable by anonymous remote users against a default-locked-down deployment. The vulnerable code path is an OS command injection (CWE-78) reachable through admin-panel functionality on EPMM versions before 12.6.0.2, 12.5.0.4, and 12.4.0.4; no end-user interaction is required (UI:N) and attack complexity is low (AC:L). The practical risk is highest where the EPMM admin interface is network-exposed and where admin credentials are weak, reused, or obtainable via a chained authentication flaw.

Signals are mixed but lean toward meaningful priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H, score 7.2 HIGH) describes a network-reachable, low-complexity command injection yielding full RCE, but gated behind PR:H - the attacker must already hold admin privileges on the EPMM admin panel, which substantially lowers the unauthenticated-attacker threat. The strongest escalating signal is EPSS: 20.35% at the 97th percentile is unusually high and indicates elevated predicted exploitation activity relative to the broader CVE population, consistent with Ivanti EPMM/MobileIron being a recurring, high-value target for threat actors. Counterbalancing this: the vulnerability is NOT in CISA KEV, and no public exploit code was identified in the provided data, so there is no confirmation of active exploitation. The net risk is that a post-authentication admin-to-RCE flaw in internet-facing MDM infrastructure is a realistic second-stage objective, especially if chained with an authentication or admin-takeover bug. The PR:H requirement is the decisive limiting factor and should be weighed explicitly: this is not a drive-by unauthenticated RCE. Conflict to verify with vendor: the high EPSS percentile sits oddly against the absence of KEV listing and any referenced POC, suggesting model-predicted rather than confirmed widespread exploitation.

An attacker who has obtained administrator credentials for the Ivanti EPMM admin panel (via phishing, credential reuse, or a chained auth bypass) submits a crafted input to an admin-panel function that is passed unsanitized to an OS command, injecting attacker-controlled shell commands. Because complexity is low and the vector is network-reachable, a single authenticated request yields code execution on the EPMM server with full confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis.