Ivanti Endpoint Manager CVE-2026-8109

Exploitation requires valid authenticated credentials (PR:L per CVSS vector) with access to invoke methods on the Ivanti Endpoint Manager Core Server over the network. The exposed dangerous method is accessible to any authenticated user or role with standard access to the Core Server's API or interface - no special administrative privileges, non-default configuration, or additional features must be enabled. The vulnerability is not dependent on specific deployment mode, platform, or optional components. The primary limiting factor is the requirement for prior authentication; unauthenticated attackers cannot exploit this vulnerability.

CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible exploitation with low complexity requiring valid prior authentication. The high confidentiality impact and absence of integrity or availability impact align with credential disclosure. EPSS and exploitation probability data are not provided, limiting quantitative risk modeling. Lack of active exploitation confirmation (no KEV status or POC evidence provided) suggests this may be pre-disclosure or early-stage vulnerability. However, the authenticated attack vector significantly limits exposure to insider threats and compromised user accounts rather than unauthenticated internet-facing attacks. Real-world risk depends heavily on: (1) authentication enforcement and account hygiene in target deployments, (2) whether exposed credentials grant elevated privileges enabling escalation, and (3) whether typical enterprise deployments restrict Core Server network access to privileged administrative subnets. The information disclosure impact is serious but bounded by the authentication requirement - this is a privilege escalation and credential compromise risk, not a perimeter breach vector.

An internal administrator or contractor with valid Endpoint Manager credentials accesses the Core Server via the network and calls the exposed dangerous method, extracting cached or stored credentials for domain accounts, service accounts, or other systems managed by Endpoint Manager. The attacker then uses the disclosed credentials to access other critical systems, pivot laterally within the network, or escalate privileges. No complex exploitation techniques or user interaction are required beyond the initial authenticated access.