What is the CVSS score of CVE-2026-5786?

CVE-2026-5786 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ivanti EPMM are affected by CVE-2026-5786?

CVE-2026-5786 is a privilege escalation vulnerability in Ivanti Endpoint Manager Mobile that allows authenticated users with low-level credentials to gain full administrative access to mobile device…

How to fix or mitigate CVE-2026-5786?

Within 24 hours: Inventory all Ivanti EPMM deployments and document current versions in use; restrict EPMM administrative console access to only essential administrators pending patch deployment. Within 7 days: Upgrade to EPMM version 12.6.1.1, 12.7.0.1, or 12.8.0.1 or later per vendor guidance; prioritize production environments first. Within 30 days: Complete upgrade of all remaining EPMM instances; audit administrative access logs for unauthorized privilege escalation attempts since deployment date.

Ivanti EPMM CVE-2026-5786

EUVD-2026-28393 HIGH

Improper Access Control (CWE-284)

2026-05-07 ivanti

GHSA-hc87-4m3j-m5vx

Authentication Bypass Ivanti

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 16:00 vuln.today

CVE Published

May 07, 2026 - 15:18 nvd

HIGH 8.8

DescriptionCVE.org

An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.

AnalysisAI

Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) allows remote authenticated attackers with low-level credentials to gain full administrative access. Affected versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 contain an improper access control flaw (CWE-284) that enables credential-holding users to bypass authorization checks and assume administrative privileges. With CVSS 8.8 (High) and network-exploitable attack vector requiring only low privileges, this represents a significant risk for enterprise mobile device management environments, though EPSS data and active exploitation status are not available at time of analysis.

Technical ContextAI

Ivanti Endpoint Manager Mobile (EPMM) is an enterprise mobility management platform for securing and managing mobile devices, applications, and content across iOS, Android, and Windows endpoints. The vulnerability stems from CWE-284 (Improper Access Control), indicating inadequate enforcement of authorization boundaries between user privilege levels. The CPE identifier (cpe:2.3:a:ivanti:endpoint_manager_mobile) confirms the software application layer is affected. This class of vulnerability typically involves missing or bypassable permission checks in administrative API endpoints, web console interfaces, or configuration management functions. The network attack vector (AV:N) combined with low attack complexity (AC:L) suggests the access control failure is in a remotely accessible interface that does not require complex exploitation techniques or race conditions. Authentication is required (PR:L), meaning attackers need valid user credentials, but critically, those credentials need not have elevated privileges initially.

RemediationAI

Immediately upgrade Ivanti EPMM to patched versions: 12.6.1.1 for 12.6.x deployments, 12.7.0.1 for 12.7.x deployments, or 12.8.0.1 for 12.8.x deployments as detailed in Ivanti's May 2026 Security Advisory (https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs). If immediate patching is not feasible, implement network segmentation to restrict EPMM console access to trusted administrative networks only via firewall rules or VPN enforcement, which reduces remote attack surface but does not eliminate risk from compromised internal accounts or VPN-authenticated attackers. Review and audit all user accounts with EPMM access, immediately disable or demote accounts with unnecessary privileges, and implement mandatory multi-factor authentication (MFA) for all user tiers to raise the barrier for credential compromise. Monitor authentication logs for unusual privilege escalation activity, failed access attempts to administrative functions by low-privileged accounts, and configuration changes outside normal administrative workflows. Note that network segmentation and MFA add operational overhead and do not fix the underlying vulnerability, requiring expedited patching as the definitive control.