- New research points to deficiencies used in targets against cloud occurrences
- The deficiencies were previously found in attack on premium
- Ivanti released a patch so apply it now
Two bugs affecting Ivantis Endpoint Manager Mobile (EPMM), which were discovered and patched in mid -May, are still abused in real life attacks. In fact, they are now targeted at cloud deposits.
This is according to CyberSecurity scientists Wiz, who recently published a new report describing the new findings.
“Wiz Research has observed continuous exploitation of these vulnerabilities in the wild targeting exposed and vulnerable EPMM deposits in cloud environments since May 16, 2025, coinciding with the publication of POCs of several sources, including Watchtowr and Project Discovery,” researchers said in their report.
Cisa added the deficiencies to Kev
The bugs in question are an approval compass error and an error for remote code execution (RCE). They are traced as CVE-2025-4427 and CVE-2025-4428, and none of them received a critical difficulty. “While none of these vulnerabilities have been assigned critical difficulty, in combination, they should definitely be treated as critical,” Wiz added.
Ivanti turned to the vulnerabilities of a patch released in mid -May this year and warned, in a security advice, about ongoing attacks.
“We are aware of a very limited number of customers whose solution has been utilized at the time of disclosure,” the company said at the time. To solve the problem, users must install Ivanti Endpoint Manager Mobile 11.12.0.5, 12.3.0.2, 12.4.0.2 or 12.5.0.1.
Originally, Ivanti believed that the problem only affected EPMM products on Prem. “It is not present in Ivanti neurons for MDM, Ivanti’s cloud-based Unified Endpoint Management Solution, Ivanti Sentry or other Ivanti products,” the company explained. “We encourage all customers who use the On-Prem EPMM product to immediately install patch.”
Meanwhile, CISA added the two bugs to its known utilized vulnerabilities (KEV), giving the Federal Civilian Executive Branch (FCCEB) agencies a deadline to patch up. No threat actors assumed responsibility for any of the attacks so far.
Via Registered
