EUVD-2026-72792
GHSA-qgx5-9x4j-gqmx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, no complexity, requires only a low-privilege account; full CIA impact reflects complete admin compromise of the MDM platform.
Primary rating from Vendor (ivanti).
CVSS VectorVendor: ivanti
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
AnalysisAI
Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker with low privileges to elevate their access to full administrator. The root cause is CWE-862 (Missing Authorization) - one or more API or functional endpoints fail to enforce role-based access controls, permitting any authenticated user to invoke admin-level operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the Ivanti EPMM instance with at minimum a low-privileged account (PR:L confirmed by CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 (High), which is coherent with the impact: a low-privileged remote user trivially escalates to admin with no interaction required and no complex preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Ivanti Endpoint Manager Mobile version 12.10.0.0, 12.9.0.2 (for the 12.9.x branch), or 12.8.0.4 (for the 12.8.x branch) per the vendor advisory at https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running EPMM and confirm exact versions deployed; audit all user accounts with EPMM access and identify which have low-privilege credentials that could exploit this vulnerability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Endpoint Manager Mobile
View allAn authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or re
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to a
Ivanti Endpoint Manager Mobile (EPMM) contains a critical code injection vulnerability (CVE-2026-1281, CVSS 9.8) that al
Ivanti Endpoint Manager Mobile (EPMM) contains an authenticated code injection in the API component, allowing authentica
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted fu
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a re
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker w
A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated atta
A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled
An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote atta
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today