What is the CVSS score of CVE-2026-5787?

CVE-2026-5787 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ivanti EPMM are affected by CVE-2026-5787?

Ivanti Endpoint Manager Mobile (EPMM) contains a critical certificate validation flaw that enables unauthenticated attackers to impersonate trusted hosts and obtain fraudulent CA-signed certificates,…

How to fix or mitigate CVE-2026-5787?

Within 24 hours: Inventory all EPMM deployments and document current versions; disable external access to EPMM management interfaces where possible and restrict network access via firewall rules to administrative networks only. Within 7 days: Contact Ivanti support to confirm patch availability and timeline for your specific EPMM version (12.6.x, 12.7.x, or 12.8.x); apply security updates for versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 if released. Within 30 days: Complete upgrade to patched EPMM version across all environments; audit certificate issuance logs for anomalous certificate requests; re-validate Sentry host registrations and revoke any certificates issued during exposure window.

Ivanti EPMM CVE-2026-5787

EUVD-2026-28394 HIGH

Improper Certificate Validation (CWE-295)

2026-05-07 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

GHSA-68p7-5fp8-cwwg

Information Disclosure Ivanti

8.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

ENISA EUVD

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 16:30 vuln.today

CVE Published

May 07, 2026 - 16:16 nvd

HIGH 8.9

DescriptionCVE.org

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.

AnalysisAI

Certificate validation bypass in Ivanti Endpoint Manager Mobile (EPMM) allows remote unauthenticated attackers to impersonate registered Sentry hosts and fraudulently obtain CA-signed client certificates. Affects all versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. High-severity network attack (CVSS 8.9) with changed scope indicating potential pivot to additional systems. No active exploitation confirmed in CISA KEV at time of analysis, but Ivanti products are frequent targets requiring immediate patching priority.

Technical ContextAI

This vulnerability exploits CWE-295 (Improper Certificate Validation) in Ivanti EPMM's certificate authority infrastructure. EPMM uses Sentry components as on-premises gateways that mediate mobile device connections to internal enterprise resources. The Sentry architecture relies on mutual TLS authentication with CA-signed client certificates to establish trust. The improper validation flaw allows attackers to bypass certificate checks during Sentry registration or authentication, enabling them to present themselves as legitimate Sentry hosts. Once accepted, attackers receive valid client certificates signed by the EPMM certificate authority, granting cryptographic credentials that can authenticate to backend systems. This fundamentally breaks the PKI trust model that secures EPMM's mobile device management infrastructure.

RemediationAI

Upgrade immediately to Ivanti EPMM version 12.6.1.1, 12.7.0.1, or 12.8.0.1 depending on your release branch as detailed in Ivanti's May 2026 Security Advisory (https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs). No workarounds are documented by the vendor. If patching requires extended maintenance windows, implement compensating controls: restrict network access to EPMM Sentry registration endpoints via firewall rules allowing only known legitimate Sentry IP addresses (requires maintaining accurate IP inventory and breaks auto-enrollment of new Sentry hosts); enable enhanced logging for all certificate issuance events and monitor for anomalous Sentry registrations from unexpected network locations (detection-only, does not prevent exploitation); review all recently issued client certificates and revoke any associated with unrecognized Sentry hostnames or IP addresses (post-compromise mitigation). These mitigations significantly impact operational flexibility and provide incomplete protection - prioritize patching over extended use of workarounds.