EUVD-2026-28397
GHSA-pr5j-p9p7-3c46
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.
AnalysisAI
Improper certificate validation in Ivanti Endpoint Manager Mobile (EPMM) enables remote unauthenticated attackers to enroll restricted devices without authorization, exposing appliance configuration details and compromising enrolled device identity integrity. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all EPMM deployments and confirm installed versions against affected ranges (pre-12.6.1.1, pre-12.7.0.1, pre-12.8.0.1); isolate any critical EPMM instances if patch verification is incomplete. Within 7 days: Apply vendor patch to upgrade EPMM to version 12.6.1.1, 12.7.0.1, or 12.8.0.1 or later; validate patch deployment across all instances. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today