What is the CVSS score of CVE-2026-10727?

CVE-2026-10727 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ivanti EPMM are affected by CVE-2026-10727?

A command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allows authenticated administrators with high privileges to execute arbitrary OS commands as root on underlying servers,…

How to fix or mitigate CVE-2026-10727?

Within 24 hours: Identify all EPMM installations and confirm affected versions (prior to 12.9.0.1, 12.8.0.3, or 12.7.0.2); enforce multi-factor authentication on all administrator accounts; audit current administrator privilege assignments. Within 7 days: Deploy privileged access management (PAM) with comprehensive session recording and alerting for all EPMM administrative activities; segment EPMM systems from production networks at firewall level; establish continuous monitoring of administrative command execution. Within 30 days: Evaluate and execute upgrades to version 12.9.0.1 (12.9.x line), 12.8.0.3 (12.8.x line), or 12.7.0.2 (12.7.x line) or later; complete forensic review of historical administrator activity logs for evidence of unauthorized command execution.

Ivanti EPMM CVE-2026-10727

EUVD-2026-35444 HIGH

OS Command Injection (CWE-78)

2026-06-09 ivanti

GHSA-5fgm-7c83-qg5j

Ivanti Command Injection Endpoint Manager Mobile

7.2

CVSS 3.1 · Vendor: ivanti

Severity by source

Vendor (ivanti) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (ivanti) · only source for this CVE.

CVSS VectorVendor: ivanti

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 15:46 vuln.today

DescriptionCVE.org

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root

Articles & Coverage 1

News 3 New Ivanti Vulnerabilities - 2 Critical, 1 High Severity Jun 10, 2026

AnalysisAI

Command injection in Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2 enables an authenticated administrator with high privileges to execute arbitrary OS commands as root on the underlying server. No public exploit identified at time of analysis, and the issue is not currently listed on the CISA KEV catalog, but Ivanti EPMM has a history of being a high-value target for nation-state actors which elevates real-world urgency. The high-privilege precondition limits opportunistic abuse but the root-level outcome makes this a credible privilege-escalation and lateral-movement vector.

Technical ContextAI

Ivanti Endpoint Manager Mobile (formerly MobileIron Core) is an on-premises unified endpoint management platform used to enroll, configure, and secure mobile devices across enterprises. The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controlled input reaches an OS shell or process-invocation primitive without adequate sanitization or argument separation. The CPE cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* indicates the application itself is affected across versions up to the listed fixed builds, and execution as root reflects that the EPMM web/admin tier runs with or can invoke privileged subprocesses.

RemediationAI

Apply the vendor-released patches by upgrading Ivanti EPMM to 12.9.0.1, 12.8.0.3, or 12.7.0.2 (matching your current maintenance branch) per the Ivanti advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727. Until patching is complete, restrict network reachability of the EPMM administrative interface to a management VLAN or VPN so that only trusted administrators can reach the authenticated endpoints, and review administrative account inventory to remove unused high-privilege accounts and rotate credentials with strong MFA - note that locking down admin access may impact remote administration workflows and break automation that uses service accounts against the admin tier. Increase log review on EPMM admin actions and subprocess execution to detect anomalous command patterns originating from authenticated sessions.