Introduction
Remote code execution on a mobile device management server can lead to the compromise of thousands of managed endpoints, credential theft, and lateral movement across enterprise networks. In October 2025, Ivanti disclosed a high-severity OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM), affecting organizations in sectors such as healthcare, finance, government, and telecommunications.
Ivanti is a major vendor in the unified endpoint management and security market. It has a global customer base, and its portfolio includes EPMM, Connect Secure, and Policy Secure. Its products are widely deployed to manage and secure mobile devices, so vulnerabilities in these platforms have a large impact on enterprise security.
Technical Information
CVE-2025-10985 is an OS command injection vulnerability in the admin panel of Ivanti Endpoint Manager Mobile (EPMM). It affects versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4, and is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
A remote attacker who is authenticated with admin privileges can send specially crafted input to the EPMM admin panel. EPMM then uses that input in operating system commands without sanitizing or validating it. The attacker can therefore execute arbitrary OS commands with the privileges of the EPMM application, which can lead to full system compromise, data exfiltration, or further lateral movement.
The root cause is insufficient input validation and sanitization in code paths that build OS commands from user-supplied data. This is not an isolated bug. Ivanti's October 2025 advisory disclosed several similar OS command injection vulnerabilities in the same admin panel, which indicates systemic weaknesses in input handling and secure coding practices. No public code snippets are available for this vulnerability.
Affected Systems and Versions
- Ivanti Endpoint Manager Mobile (EPMM) admin panel
- Affected versions: All versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4
- Only systems where an attacker can obtain admin-level authenticated access are vulnerable
Vendor Security History
Ivanti has had several high-profile vulnerabilities across its product lines in 2024 and 2025, including:
- Zero-day exploits in Ivanti Connect Secure and Policy Secure appliances (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282, CVE-2025-0283)
- Active exploitation of EPMM vulnerabilities in May 2025 (CVE-2025-4427, CVE-2025-4428)
- Clusters of similar OS command injection and path traversal vulnerabilities in EPMM admin panel code
Ivanti's patch response has varied, with delays in some past incidents. The company has publicly committed to improving its security posture and transparency, but similar vulnerabilities keep appearing, which indicates ongoing problems with secure development and input validation.
