In May 2025, Ivanti disclosed two critical vulnerabilities in Endpoint Manager Mobile, CVE-2025-4427 and CVE-2025-4428. On their own each is limited, but chained together they let an unauthenticated attacker run code on an exposed server. Researchers observed exploitation in the wild within a couple of days of disclosure, hitting healthcare, telecom, aviation, and government targets.
The pattern is familiar: internet-facing management appliances are attractive because they sit at the edge and hold the keys to a fleet of devices. Attackers watch for these advisories and move fast, often before defenders finish reading them.
For a small or mid-size business, the lesson isn't about this specific product. It's that any device-management, VPN, or firewall appliance exposed to the internet needs an owner and a patch plan measured in days, not quarters. Know what you have facing the public internet, subscribe to the vendor's security advisories, and treat edge-appliance patches as urgent.
Further reading: original source ↗
Want this handled for you?
This is exactly the kind of thing our website security work takes off your plate. Start with a free, no-pressure look at your site.
Come aboard