OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
References
| Link | Resource |
|---|---|
| https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Oct 2025, 18:07
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* | |
| First Time |
Ivanti endpoint Manager Mobile
Ivanti |
|
| References | () https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US - Vendor Advisory |
14 Oct 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-14 15:16
Updated : 2025-10-15 18:07
NVD link : CVE-2025-10242
Mitre link : CVE-2025-10242
CVE.ORG link : CVE-2025-10242
JSON object : View
Products Affected
ivanti
- endpoint_manager_mobile
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')