Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild (Campaign)

Wiz Threat Research confirmed active exploitation of a chained Ivanti EPMM vulnerability (CVE-2025-4427 + CVE-2025-4428) that enables unauthenticated remote code execution due to unsafe Java Expression Language use and misconfigured Spring Security. Exploitation began shortly after public disclosure and PoC release; observed post-exploitation activity includes Sliver C2 beaconing, MySQL database dumping, web shells disguised as files like 401.jsp and css.css, and reverse/fileless shells, affecting EPMM versions 11.12.0.4, 12.3.0.1, 12.4.0.1, 12.5.0.0 and earlier.