Ivanti Endpoint Manager Mobile (EPMM) has a code injection vulnerability in its API component that allows authenticated attackers to execute arbitrary code remotely. This flaw stems from an insecure use of the Hibernate Validator library. The vulnerability has a high severity score of 7.2 and has been exploited in the wild.