Ivanti EPMM CVE-2025-4428 Feature Usage API Exploit

Daniel Jeremiah@daniyyell

•updated Feb 11, 2026•0•20

The rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. Specifically, it looks for unauthenticated or suspicious requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of exploitation, such as `format` parameters with values like `${`, `Runtime`, `exec`, or `getRuntime`.