Ivanti EPMM CVE-2025-10985

Requires an authenticated session with administrator privileges on the Ivanti EPMM admin panel (CVSS PR:H); the vulnerable code path is an admin-panel function that passes attacker input into an OS command. This is NOT exploitable by unauthenticated or low-privileged users against a default configuration - the admin-privilege prerequisite is the primary limiting factor. Realistic exploitation therefore depends on prior admin credential compromise or chaining with a separate authentication/privilege-escalation flaw; organizations should treat admin-panel exposure to untrusted networks as the key risk amplifier. Fixed in versions 12.6.0.2, 12.5.0.4, and 12.4.0.4.

Signals are mixed but lean toward elevated priority. The CVSS 3.1 base score is 7.2 (HIGH) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and low-complexity, but gated behind high privileges (PR:H, admin). That privilege requirement is the single biggest risk-reducer, confining exploitation to an attacker who already holds admin credentials. Working against that mitigation, the EPSS score of 20.35% (97th percentile) is strikingly high for a privilege-gated flaw and indicates meaningful predicted exploitation interest, likely reflecting Ivanti EPMM's (formerly MobileIron Core) long history of being targeted and chained in real attacks. There is no CISA KEV listing and no public exploit referenced in the provided data, so active exploitation is NOT confirmed and the high EPSS is a probabilistic forecast, not evidence of in-the-wild use. No SSVC decision data was supplied in the input, so exploitation/automatable/technical-impact cannot be scored against that framework. Net: a real priority for anyone exposing an EPMM admin panel, especially since the admin-only barrier can be undermined if paired with an authentication bypass or credential compromise - a recurring pattern for this vendor.

An attacker who has obtained administrator access to the Ivanti EPMM admin panel (via stolen/weak credentials or a chained auth bypass) submits specially crafted input to a vulnerable admin function, which passes it unsanitized to an OS command. This yields arbitrary command execution on the EPMM appliance with the service's privileges, enabling full compromise of the mobile-device-management server. No public exploit code was identified in the provided data, and the AV:N/AC:L vector means the attack is network-based and technically simple once admin access is held.