‘Ongoing’ Ivanti hijack bug exploitation reaches clouds
The “ongoing exploitation” of two Ivanti bugs has now extended beyond on-premises environments and hit customers’ cloud instances, according to security shop Wiz.
CVE-2025-4427 is an authenticated bypass vulnerability and CVE-2025-4428 is a post-authentication remote-code execution (RCE) flaw. Together they allow a miscreant to run malware on a vulnerable deployment and hijack it. Both holes affect Ivanti Endpoint Manager Mobile (EPMM), which is used to manage company-issued devices and applications and secure access to sensitive corporate data.
There are at least a couple proof-of-concept (POC) exploits on the loose for these holes, so if you haven’t already: Patch now.
Ivanti disclosed the bugs and issued patches for both last week, warning in the security alert it was “aware of a very limited number of customers” whose products had been exploited. “The issue only affects the on-prem EPMM product,” the vendor said in a subsequent advisory.
The flaws involve some unnamed open source libraries used in its product, according to a statement an Ivanti spokesperson emailed The Register Tuesday:
Wiz, on the other hand, asserts the exploitation extends into customers’ cloud environments.
“Wiz Research has observed ongoing exploitation of these vulnerabilities in-the-wild targeting exposed and vulnerable EPMM instances in cloud environments since May 16,” the cloud security firm’s bug hunters Merav Bar, Shahar Dorfman, and Gili Tikochinski wrote Tuesday.
While we don’t know who is behind the attacks, in at least once instance the miscreants used their ill-gotten access to deploy a remote-control program called Sliver within victims’ cloud environments, we’re told. Sliver is a favorite of all types of baddies, from Chinese and Russian government goons to ransomware gangs, because it ensures long-term total access to the compromised system for future snooping, ransomware deployment, credential stealing campaigns, and many other illicit activities.
On Monday, the US govt’s Cybersecurity and Infrastructure Security Agency (CISA) added both bugs to its Known Exploited Vulnerabilities Catalog.
While neither CVE-2025-4427 nor CVE-2025-442 is considered critical on their own, receiving CVSS severity scores of 5.3 (medium) and 7.2 (high) out of 10, respectively, “in combination they should certainly be treated as critical,” according to the Wiz kids.
The soon-to-be-Google-owned security shop said the attacks coincide with the emergence of POCs including those published by watchTowr and ProjectDiscovery on May 15.
About those open-source libraries
Wiz also indicates that the unnamed open-source libraries involved the insecure processing of Java Expression Language, and Spring.
We’re told CVE-2025-4428 stems from the unsafe use of Java Expression Language in error messages. “It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows attacker-controlled EL (Expression Language) injection,” the researchers wrote.
Meanwhile, CVE-2025-4427, according to Wiz, is caused by improper request handling in EPMM’s route configuration:
The security researchers say they spotted “multiple malicious payloads” being deployed post exploitation, including the Sliver code mentioned earlier.
This remote-control tool used 77.221.157[.]154 as its command-and-control server, which is significant because Wiz spotted this same IP address being used to attack similar flaws in exposed Palo Alto Networks’ appliances in the fall. That didn’t end well for buggy PAN-OS kits.
According to the bug hunters, the IP address is still in operation and its TLS certificate hasn’t changed since November 2024. “This continuity leads us to conclude that the same actor has been opportunistically targeting both PAN-OS and Ivanti EPMM appliances,” the Wiz kids wrote.
The Register asked Ivanti for more information about the scope of exploitation, the open-source libraries linked to the security flaws, and if the bugs affect cloud-based products. We will update this story if the software maker responds to our questions. ®
READ MORE HERE