Phoenix
Sigma IntelligenceBeta
Emerging Threats
CVE2025

CVE-2025-4427

1Rules
1References
1Folders
2025-05-20Latest
Summary

CVE-2025-4427 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on webserver.

Related Detections
Search this threat
Emerging Threathighexperimental

Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0002 · ExecutionT1203 · Exploitation for Client Execution+3
Swachchhanda Shrawan Poudel (Nextron Systems)Tue May 202025
References
1
Resolving title…
labs.watchtowr.com