CVE-2025-55129Ivanti EPMM addUser validation bypass and impersonation
What broke
Ivanti EPMM did not validate the addUser path the way the rest of the admin API did. An attacker could create a user or impersonate one. Ivanti patched. Ivanti MDM products have a long KEV history even when a specific ID is not yet listed.
Why it matters
EPMM decides which devices are trusted for Conditional Access and which users get email. Impersonation there bypasses the device-trust story your IdP thinks it is enforcing.
What to do
- Patch EPMM. Confirm every appliance, including DR.
- Review users created through the API around the disclosure window.
- Do not expose EPMM admin to the internet. Pair device compliance with phishing-resistant MFA, not instead of it.
After you patch
Patching closes the entry point. It does not remove access an attacker established through it.
- Revoke sessions and API tokens on the affected system rather than only resetting passwords.
- Audit accounts, tokens, and administrative changes made during the exposure window.
- Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
- Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.
Sources
- NVD: CVE-2025-55129
- Ivanti security advisory
Related identity CVEs
Related on Start with Identity
- CVEIvanti EPMM (MobileIron Core) unauthenticated API access
Every supported EPMM 11.8-11.10 release exposed restricted API functionality with no login. Attackers pulled user and device data, then chained CVE-2023-35081.
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- CVEIvanti Connect Secure SAML SSRF, chained to auth bypass
SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CIS
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogA CVSS 10.0 Metabase zero-day handed admin access through the password reset endpoint
CVE-2026-72898 lets an unauthenticated attacker inject SQL through Metabase's password reset endpoint and take administrative control. It was exploited as a zer
- VendorAWS Secrets Manager
strong