What is the CVSS score of CVE-2026-7821?

CVE-2026-7821 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ivanti EPMM are affected by CVE-2026-7821?

Ivanti Endpoint Manager Mobile (EPMM) contains a certificate validation flaw allowing unauthenticated remote attackers to enroll unauthorized devices and access appliance configuration, directly…

How to fix or mitigate CVE-2026-7821?

Within 24 hours: Inventory all EPMM deployments and confirm installed versions against affected ranges (pre-12.6.1.1, pre-12.7.0.1, pre-12.8.0.1); isolate any critical EPMM instances if patch verification is incomplete. Within 7 days: Apply vendor patch to upgrade EPMM to version 12.6.1.1, 12.7.0.1, or 12.8.0.1 or later; validate patch deployment across all instances. Within 30 days: Audit enrollment logs for unauthorized device onboarding during vulnerability window; revoke and re-enroll any suspicious devices; review appliance configuration exports for unauthorized access.

Ivanti EPMM CVE-2026-7821

EUVD-2026-28397 HIGH

Improper Certificate Validation (CWE-295)

2026-05-07 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

GHSA-pr5j-p9p7-3c46

Information Disclosure Ivanti

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

ENISA EUVD

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 16:31 vuln.today

CVE Published

May 07, 2026 - 16:16 nvd

HIGH 7.4

DescriptionCVE.org

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.

AnalysisAI

Improper certificate validation in Ivanti Endpoint Manager Mobile (EPMM) enables remote unauthenticated attackers to enroll restricted devices without authorization, exposing appliance configuration details and compromising enrolled device identity integrity. Affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. CVSS 7.4 with high attack complexity suggests exploitation requires specific timing or conditions. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though Ivanti products have been frequent targets of nation-state actors in recent years.

Technical ContextAI

Ivanti Endpoint Manager Mobile (formerly MobileIron) manages enterprise mobile device enrollment and policy enforcement. The vulnerability stems from CWE-295 (Improper Certificate Validation), where the EPMM server fails to properly validate certificates during device enrollment processes. This certificate validation failure allows attackers to bypass enrollment restrictions intended to prevent unauthorized devices from registering with the management platform. The flaw affects the enrollment API endpoints that authenticate new devices attempting to join the managed fleet. Versions 12.6.x, 12.7.x, and 12.8.x lines are vulnerable, with patches released as point releases (.1) indicating targeted security fixes rather than feature updates.

RemediationAI

Upgrade to Ivanti EPMM version 12.6.1.1, 12.7.0.1, or 12.8.0.1 depending on your current major version line, as documented in the May 2026 Security Advisory at https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs. Organizations should prioritize patching internet-facing EPMM instances first. As compensating controls until patching completes, restrict network access to EPMM enrollment endpoints to known corporate IP ranges or VPN gateways using firewall rules, though this may impact legitimate remote enrollment scenarios for traveling employees. Monitor enrollment logs for unexpected device registrations, particularly devices appearing in restricted categories or with unusual certificate chains. Implement multi-factor approval workflows for new device enrollments if supported by your EPMM version, adding human verification as a secondary control layer. Review recently enrolled devices (past 30-90 days) for anomalies that might indicate historical exploitation. Note that network restrictions may conflict with BYOD or remote worker enrollment use cases and require policy adjustments.