What is the CVSS score of CVE-2026-5788?

CVE-2026-5788 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Ivanti EPMM are affected by CVE-2026-5788?

CVE-2026-5788 is a high-severity remote authentication bypass in Ivanti Endpoint Manager Mobile that allows unauthenticated network attackers to invoke arbitrary methods and compromise system…

How to fix or mitigate CVE-2026-5788?

Within 24 hours: Inventory all Ivanti EPMM deployments and document current versions; restrict network access to EPMM infrastructure to trusted networks only via firewall/WAF rules. Within 7 days: Upgrade affected instances to patched versions (12.6.1.1, 12.7.0.1, or 12.8.0.1 depending on current branch); validate upgrades in staging environment first. Within 30 days: Conduct forensic review of EPMM access logs for unauthorized method invocations; implement enhanced monitoring for anomalous EPMM API activity; document any unpatched systems with explicit risk acceptance.

Ivanti EPMM CVE-2026-5788

EUVD-2026-28395 HIGH

Improper Access Control (CWE-284)

2026-05-07 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

GHSA-wwfp-6c8c-qg35

Authentication Bypass Ivanti

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

ENISA EUVD

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 16:30 vuln.today

CVE Published

May 07, 2026 - 16:16 nvd

HIGH 7.0

DescriptionCVE.org

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.

AnalysisAI

Remote unauthenticated attackers can invoke arbitrary methods in Ivanti Endpoint Manager Mobile (EPMM) via improper access control flaws, enabling authentication bypass and potential system compromise. Affects versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. The CVSS vector indicates network-accessible exploitation with high attack complexity, resulting in high integrity impact and limited confidentiality/availability impact. No active exploitation confirmed via CISA KEV at time of analysis, though the authentication bypass tag and Ivanti's history of targeted attacks warrant elevated monitoring.

Technical ContextAI

Ivanti Endpoint Manager Mobile (EPMM) is an enterprise mobility management platform for securing and managing mobile devices, applications, and content. This vulnerability stems from CWE-284 (Improper Access Control), where authentication or authorization checks fail to properly restrict which methods can be invoked remotely. In web application frameworks and API endpoints, improper access control typically occurs when business logic functions are exposed without adequate authentication gates, or when authorization checks can be bypassed through parameter manipulation, path traversal, or direct object references. The affected versions span three major release branches (12.6.x, 12.7.x, 12.8.x), suggesting the vulnerability exists in shared core access control logic rather than a single component. The 'arbitrary method invocation' language indicates attackers may call internal functions directly, potentially bypassing intended application workflows and security boundaries.

RemediationAI

Upgrade Ivanti EPMM to patched versions: 12.6.1.1 or later for 12.6.x deployments, 12.7.0.1 or later for 12.7.x deployments, or 12.8.0.1 or later for 12.8.x deployments as documented in Ivanti's May 2026 Security Advisory at https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs. Follow Ivanti's upgrade procedures including pre-upgrade backups and compatibility testing in non-production environments. If immediate patching is not feasible, implement network-level compensating controls: restrict EPMM administrative interfaces to trusted management networks only via firewall rules, deploy web application firewall (WAF) with strict allow-listing of known-good API endpoints and methods, and enable comprehensive logging of all API invocations for anomaly detection. Note that network restrictions may limit remote administration capabilities and require VPN access for administrators. Monitor Ivanti's advisory for additional indicators of compromise or detection guidance given the authentication bypass nature.