Ivanti patches two zero-days under active attack as intel agency warns customers – Source: go.theregister.com

Australia’s intelligence agency is warning organizations about several new Ivanti zero-days chained for remote code execution (RCE) attacks. The vendor itself has said the vulns are linked to two mystery open source libraries which it declined to name.

The Australian Signals Directorate (ASD) issued a critical warning about CVE-2025-4427 (5.3) and CVE-2025-4428 (7.2) earlier today. Individually, the two bugs seem fairly unalarming, but together they can be, and have been, used to exploit Ivanti customers.

We are actively working with our security partners and the maintainers of the libraries to determine if a CVE against the libraries is warranted for the benefit of the broader security ecosystem

“We are aware of a very limited number of customers whose solution has been exploited at the time of disclosure,” said Ivanti in its advisory, which was released alongside the patches for Ivanti Endpoint Manager Mobile (EPMM).

EPMM is used by Ivanti customers to manage company-issued devices and applications on those devices, while providing secure access to sensitive or confidential content such as company documents.

Although EPMM can be used by all types of organizations, the ASD’s advisory stated that the information was intended for large organizations and government entities, suggesting the EPMM vulnerabilities are less likely to affect smaller companies.

The affected EPMM versions include:

• 11.12.0.4 and earlier
• 12.3.0.1 and earlier
• 12.4.0.1 and earlier
• 12.5.0.0 and earlier

All four series of the software have patches available, but if customers can’t apply them right away, they can mitigate the threat of chained attacks by filtering access to the API using either the Portal ACLs functionality or via an external WAF, Ivanti said.

If customer are concerned about whether they are compromised or not, Ivanti urged them to contact its support team in lieu of providing indicators of compromise.

“The investigation is ongoing and Ivanti does not have reliable atomic indicators at this time,” it said.

Open source dependencies

The reason for the lack of insights on this right could potentially be due to the fact that the buggy code isn’t Ivanti’s, according to the vendor. It instead belongs to two unspecified open source libraries that EPMM relies on, and Ivanti is working with their maintainers to understand whether separate CVEs need to be assigned for the libraries themselves. The implication is that the broader security ecosystem – everyone else who uses those libraries – will also be affected.

In an FAQ, Ivanti said the “vulnerabilities are associated with two open source libraries integrated into EPMM. The use of open source code is standard practice used by all major technology companies.”

“Ivanti is committed to using open source code responsibly,” it added. “One of the ways that we do this is by employing enterprise-grade software composition analysis tools and SBOMs to identify potential issues in the libraries that we use.” 

As for the unnamed libraries, the vendor said that: “At the time of disclosure, CVEs have not been reserved by the maintainers of the library for the security issues in the open source libraries. We are actively working with our security partners and the maintainers of the libraries to determine if a CVE against the libraries is warranted for the benefit of the broader security ecosystem.”

Make-me-admin bug

Also patched yesterday was another Ivanti vulnerability, CVE-2025-22462 (9.8), affecting on-prem instances of Neurons for ITSM. 

It’s nearly a maximum-severity bug allowing remote attackers to give themselves admin rights. Unlike the aforementioned zero-days, however, this hasn’t yet been exploited in the wild.

Patches are available now for the affected versions (2023.4, 2024.2, and 2024.3,) but due to no attacks being observed, there are no IOCs to share.

• Apple patched one first, but Microsoft’s blasted five exploited flaws this Pa-Tu
• Enterprise tech dominates zero-day exploits with no signs of slowdown
• Suspected Chinese spies right now hijacking buggy Ivanti gear – for third time in 3 years
• CISA spots spawn of Spawn malware targeting Ivanti flaw

Ivanti also had little to share in terms of mitigations for the bug, other than its previously espoused best practices. As long as customers secure their IIS website, restrict access to limited IP addresses and domains, and Neurons for ITSM is running in a demilitarized zone when authenticating remote workers, then their environments can be considered less at-risk.

Provided these best practices are implemented, Ivanti said customers can effectively consider this bug a 6.9 on the CVSS, instead of the near-maximum 9.8 it would be without proper configuration. ®