What is the CVSS score of CVE-2026-8109?

CVE-2026-8109 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Ivanti Endpoint Manager CVE-2026-8109

EUVD-2026-29489 MEDIUM

Exposed Dangerous Method or Function (CWE-749)

2026-05-12 ivanti

GHSA-5fg5-92p6-87xv

Information Disclosure Ivanti

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 15:32 vuln.today

CVE Published

May 12, 2026 - 14:29 nvd

MEDIUM 6.5

DescriptionCVE.org

An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.

AnalysisAI

Remote authenticated attackers can exploit an exposed dangerous method on the Core Server of Ivanti Endpoint Manager versions before 2024 SU6 to leak access credentials. The vulnerability requires valid authentication credentials to exploit and does not allow code execution or system modification, but compromises confidentiality by exposing sensitive authentication material that could facilitate lateral movement or account takeover.

Technical ContextAI

Ivanti Endpoint Manager's Core Server exposes a method that is not properly restricted or secured, falling under CWE-749 (Exposed Dangerous Method or Function). This represents an API or internal function design flaw where privileged operations or sensitive data access are inadequately protected from authenticated users. The vulnerability affects the Ivanti Endpoint Manager product line, a widely-deployed enterprise endpoint management and security solution. The exposed method likely handles credential storage, retrieval, or management operations, allowing authenticated users to bypass normal access controls and retrieve credentials that should remain protected.

RemediationAI

Immediately upgrade Ivanti Endpoint Manager to version 2024 SU6 or later per the vendor security advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US. If upgrade cannot be immediately deployed, restrict network access to the Ivanti Endpoint Manager Core Server to trusted administrative networks and subnets only; implement firewall rules limiting access to the Core Server port to authorized administrative staff. Additionally, audit and enforce principle of least privilege for user accounts with access to Endpoint Manager administration functions, and monitor audit logs for unusual credential retrieval or API method calls. Disable or restrict the dangerous exposed method via application configuration if supported by your Endpoint Manager version; consult vendor documentation for method-specific hardening options. These compensating controls reduce but do not eliminate risk - patching remains the primary remediation.