MDM Monthly: May 2025 Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for May 2025, covering Microsoft Intune and Windows, Apple iOS and macOS, Android Enterprise, Jamf and Ivanti.

The story this month is about the management server itself. Ivanti disclosed two flaws in Endpoint Manager Mobile (EPMM) that, chained together, give an attacker remote code execution without logging in, and Ivanti says they were exploited in the wild. Alongside that, May’s Patch Tuesday carried five exploited Windows flaws. The details follow.

Executive Summary

Ivanti disclosed two flaws in Endpoint Manager Mobile on May 13, CVE-2025-4427 and CVE-2025-4428, that chain into unauthenticated remote code execution and were exploited in the wild to a limited degree.
Microsoft’s May Patch Tuesday fixed five exploited Windows flaws, and Google’s May bulletin lists a FreeType flaw, CVE-2025-27363, with limited, targeted exploitation.
Intune’s May release marks rooted corporate Android devices noncompliant automatically and adds an Endpoint Privilege Management Deny rule.

Executive view: cost and risk

Opex: An emergency patch for a management server means an out-of-cycle change window, a backup and a rollback plan. Searching HTTP logs for the exploited endpoints and filtering API access are extra hours when the alert lands.
Capex: Self-hosted MDM carries hosting, patching and monitoring costs that a cloud service moves to the vendor, so compare the two at your next renewal. DigiCert is retiring its legacy Managed PKI in October 2025, which affects certificate issuance for Jamf customers using it.
Enterprise impact: An MDM server can push configuration, apps and commands to every managed device, so a remote code execution flaw on it is a fleet-wide risk. CISA listing both flaws as exploited sets the clock for everyone.
Decision needed: Decide whether the on-premises MDM server stays on premises, and agree a maximum number of days from an exploited-flaw advisory to a patched server.

Download the one-page executive brief (PDF)

Ivanti EPMM: two flaws chained into remote code execution

On May 13 Ivanti published fixes for two flaws in EPMM, its on-premises mobile device management product:

CVE-2025-4427: An authentication bypass in the EPMM API, scored 5.3.
CVE-2025-4428: A remote code execution flaw that needs authentication, scored 7.2.

Chained, the two give an attacker remote code execution without authenticating. Rapid7 quotes Ivanti as saying the flaws were “exploited in the wild to a limited degree.” The affected versions are 11.12.0.4, 12.3.0.1, 12.4.0.1, 12.5.0.0 and prior, and the fixed versions are 11.12.0.5, 12.3.0.2, 12.4.0.2 and 12.5.0.1. CISA added both flaws to its Known Exploited Vulnerabilities catalog on May 19.

Government guidance followed within days. The Australian Signals Directorate’s cyber security centre published an alert on May 14 pointing to Ivanti’s analysis guidance, and Ireland’s NCSC published an advisory the same day. The EU’s CERT-EU advisory 2025-018 recommends:

Prioritize internet-facing EPMM servers for patching.
Filter access to the API using Portal ACLs or a web application firewall.
Apply Ivanti’s hot-fix RPM, available through a support case with Ivanti.
Search HTTP logs for requests to /mifs/rs/api/v2/featureusage?format= and /mifs/rs/api/v2/featureusage_history?format= where the format value is anything other than csv or json.

Microsoft: five exploited zero-days

BleepingComputer counts 72 flaws in the May 13 Patch Tuesday. Five were exploited:

CVE-2025-30400: A Desktop Window Manager elevation of privilege flaw.
CVE-2025-32701 and CVE-2025-32706: Two Common Log File System (CLFS) elevation of privilege flaws.
CVE-2025-32709: An Ancillary Function Driver for WinSock elevation of privilege flaw.
CVE-2025-30397: A Scripting Engine memory corruption flaw.

Two were publicly disclosed: CVE-2025-26685, a Defender for Identity spoofing flaw, and CVE-2025-32702, a Visual Studio remote code execution flaw. The Windows 11 cumulative updates are KB5058411 and KB5058405, and the Windows 10 update is KB5058379.

Apple: iOS 18.5

Apple released iOS 18.5, iPadOS 18.5 and macOS Sequoia 15.5 on May 12, and iPadOS 17.7.8 on May 19. Apple’s security releases page lists the updates without published CVE entries for these releases.

Android Enterprise: a FreeType flaw

Google’s May bulletin, published May 5 with patch levels 2025-05-01 and 2025-05-05, says CVE-2025-27363, a FreeType remote code execution flaw, may be under limited, targeted exploitation. The most severe other issues are rated High.

Jamf: Pro 11.17 and certificate changes

Jamf released Pro 11.17 on May 20. It adds an App Switcher, and support for DigiCert ONE Trust Lifecycle Manager ahead of DigiCert’s retirement of its legacy Managed PKI in October 2025. If you issue device certificates through DigiCert, that date is worth putting on a calendar now.

Intune: the 2505 service release

Devicie’s summary of 2505 lists:

Inventory: The hardware properties catalog grows to 74 properties for Apple devices and 32 for Android.
Remote Help: Unattended remote help is available on Samsung and Zebra Android devices.
Compliance: Rooted corporate-owned and work-profile Android devices are marked noncompliant automatically.
Linux: Microsoft Defender scan exclusions can be set from Intune.
Endpoint Privilege Management: A Deny rule blocks specific files from elevating.

What to watch

June 10: Patch Tuesday.
June: Apple’s WWDC is expected, which usually previews the next management changes.
October 14: Windows 10 reaches end of support.

My take

My position: Treat an on-premises MDM server as internet-facing infrastructure that gets patched in days, not in the monthly cycle.

An MDM server is one of the most privileged systems you run. It can push apps, change settings, read inventory and wipe devices across the whole fleet. When it sits on the internet and has a flaw that needs no login, an attacker gets a lever on every device it manages.

That’s why I treat an on-premises MDM server like a firewall or a VPN gateway, not like a line-of-business app. It gets an owner, a patch window measured in days and an alert when a vendor bulletin lands. May’s guidance shows what the response looks like: patch first, restrict the API path, then search logs for the request pattern.

If you run Ivanti EPMM, confirm your version against the fixed builds above. If you can’t say who gets paged when your MDM vendor publishes an exploited-vulnerability notice, fix that this week.

My prediction: by the end of 2027 at least one of Ivanti, Jamf or Omnissa announces an end-of-sale or end-of-support date for its self-hosted MDM server.

What to do next

Confirm the EPMM build against the fixed versions, and apply the hot-fix or upgrade.
Restrict access to the EPMM API, and search web logs for the featureusage request pattern.
Name an owner and a patch target in days for every on-premises management server.
Apply the May 13 Windows updates.
Update iPhones and iPads to iOS 18.5.
Check Android fleets for patch level 2025-05-05.
If you use DigiCert for device certificates, plan the move before October.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.