Ivanti Endpoint Manager CVE-2026-8110

Requires local authenticated access to a Windows endpoint with Ivanti Endpoint Manager agent installed (version prior to 2024 SU6). The attacker must have at least standard user privileges (PR:L) on the target system to interact with the file system or registry. No special EPM configuration is required - the vulnerability exists in default agent deployments due to inherent permission misconfigurations. Exploitation is limited to the local system context (S:U scope unchanged), meaning the attacker cannot directly compromise other managed endpoints without separate attacks, though obtained SYSTEM credentials or access to the EPM console could enable further lateral movement. No user interaction (UI:N) is required once local access is achieved. Attack complexity is low (AC:L) as standard Windows API calls or built-in tools like icacls and reg.exe can identify and exploit weak permissions.

Real-world risk is moderate-to-high for organizations with Ivanti EPM deployments. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity and low privileges required, meaning any domain user with access to a managed endpoint can exploit this. The Complete impact to Confidentiality, Integrity, and Availability (C:H/I:H/A:H) reflects full SYSTEM compromise. However, exploitation requires prior local access, limiting this to insider threats, compromised user accounts, or as a second-stage attack following initial access via phishing or other vectors. No CISA KEV listing or public exploit identified, suggesting this is not yet actively exploited at scale, though absence of EPSS data prevents quantitative exploitation probability assessment. The primary concern is lateral movement: an attacker compromising a standard user account could escalate to SYSTEM on any EPM-managed endpoint, then pivot to additional systems or access credentials stored by the management agent. Organizations should prioritize patching based on whether EPM agents are deployed on sensitive systems (domain controllers, file servers, developer workstations) where privilege escalation would enable significant further compromise.

An attacker who has compromised a standard domain user account via phishing gains access to a workstation running the vulnerable Ivanti EPM agent. Enumerating the system, they discover the agent's configuration directory or registry keys have overly permissive ACLs allowing modification by the Users group. The attacker plants a malicious DLL in the agent's plugin directory or modifies an agent configuration file to execute arbitrary code during the next scheduled agent task. When the EPM agent service (running as SYSTEM) loads the malicious component, the attacker's code executes with SYSTEM privileges, allowing them to dump credentials from LSASS, disable security controls, and establish persistence.