Ivanti EPMM CVE-2026-5786

Requires valid credentials for any authenticated EPMM user account with low-level privileges (PR:L). The vulnerability affects EPMM instances accessible over the network (AV:N), meaning both internet-facing deployments and internal network installations are exploitable by attackers with network connectivity to the EPMM console or API endpoints. No user interaction (UI:N) or complex configurations are required. The access control flaw exists in default EPMM configurations across affected version branches (12.6.x prior to 12.6.1.1, 12.7.x prior to 12.7.0.1, and 12.8.x prior to 12.8.0.1), meaning all unpatched installations are vulnerable regardless of deployment customization. The only limiting factor is the authentication requirement, meaning attackers must first acquire valid user credentials through credential theft, social engineering, or compromise of integrated authentication systems (Active Directory, LDAP, SAML providers).

Real-world risk is high based on multiple converging factors. The CVSS 8.8 score reflects maximum impact across confidentiality, integrity, and availability (C:H/I:H/A:H), meaning administrative access grants full control over managed mobile devices, corporate data access policies, and endpoint configurations. The AV:N/AC:L/PR:L/UI:N vector indicates this is trivially exploitable by any authenticated user over the network without user interaction or complex preconditions. EPMM platforms typically manage hundreds to thousands of corporate mobile devices containing sensitive business data, making administrative compromise particularly impactful. The vulnerability enables lateral movement from low-privileged user accounts (potentially compromised contractors, former employees with lingering access, or social engineering victims) to full platform control. EPSS score and KEV status are unavailable, limiting assessment of real-world exploitation likelihood, but Ivanti's history as a target for threat actors (previous vulnerabilities in Pulse Secure, Connect Secure products) elevates concern. The availability of vendor-confirmed patches across three version branches suggests this was identified through internal security review rather than incident response, indicating no confirmed active exploitation at disclosure. However, absence of KEV listing does not rule out targeted exploitation in unpatched environments post-disclosure. Priority should be HIGH for organizations running affected EPMM versions, especially those with external-facing authentication portals or large populations of low-privileged user accounts.

An attacker obtains credentials for a low-privileged EPMM user account through phishing, credential stuffing, or insider access (such as a help desk technician or contractor with read-only mobile device visibility). The attacker authenticates to the EPMM web console or API from any internet-connected location and exploits the improper access control vulnerability to bypass authorization checks, directly accessing administrative functions without requiring password changes or additional authentication challenges. With administrative access achieved, the attacker deploys malicious mobile device configurations, exfiltrates corporate data from managed endpoints, installs rogue applications across the enterprise mobile fleet, or creates backdoor administrator accounts for persistent access.