Introduction
Remote code execution through a trusted management interface can undermine the security of thousands of managed devices in an enterprise. CVE-2025-10243 is that kind of flaw. It sits in the admin panel of Ivanti Endpoint Manager Mobile (EPMM) and lets authenticated admin users inject OS commands.
Ivanti is a leading vendor of endpoint and mobile device management software, and EPMM is widely deployed in healthcare, finance, government, and other critical sectors. Because the platform enforces device policy and configuration centrally, a vulnerability in its admin interface has an outsized impact.
Technical information
CVE-2025-10243 is an OS command injection vulnerability classified under CWE-78. The flaw is in the admin panel of Ivanti Endpoint Manager Mobile (EPMM) prior to versions 12.6.0.2, 12.5.0.4, and 12.4.0.4. An authenticated attacker with admin privileges can supply crafted input to administrative functions, and the backend then executes arbitrary operating system commands with the privileges of the EPMM application.
The root cause is insufficient input validation in one or more admin panel features that pass user-supplied data to OS command execution routines. Attackers can use this to inject shell metacharacters and additional commands. Exploitation requires valid admin credentials, but once an attacker is authenticated, the attack complexity is low. No public code snippets or detailed vulnerable parameter names are available as of this writing.
Affected systems and versions
- Ivanti Endpoint Manager Mobile (EPMM) admin panel
- Versions prior to 12.6.0.2
- Versions prior to 12.5.0.4
- Versions prior to 12.4.0.4
Only on-premises EPMM deployments are affected. Ivanti Neurons for MDM (cloud-based) and other Ivanti products are not affected.
Vendor security history
Ivanti has had multiple high-severity vulnerabilities in EPMM and related products throughout 2024 and 2025. CVE-2025-4427 and CVE-2025-4428, also OS command injection flaws, were actively exploited by advanced threat actors, including China-nexus groups. The company has improved its patch response cadence, but recurring input validation issues remain a concern.
