Ivanti EPMM EUVD-2026-28395

Per the description, no special configuration is stated as required: a remote unauthenticated attacker can invoke arbitrary methods against Ivanti EPMM instances running versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 (the AV:N/AC:L/PR:N/UI:N vector implies default, network-reachable deployments). The primary limiting factors are version (only pre-patch builds are affected) and network reachability of the EPMM management interface - an appliance restricted to internal/VPN access is far less exposed than an internet-facing one. The specific vulnerable method, endpoint, or feature that must be reachable is not described in the available sources.

Signals are strongly conflicting and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a maximally exposed flaw - network-reachable, low-complexity, unauthenticated, no user interaction - yielding a 9.8 'critical' score, and the vuln.today Decision label is 'emergency'. Against this, the exploitation-likelihood signals are notably cool: EPSS is only 0.19% (41st percentile), there is no CISA KEV listing, and CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The SSVC 'partial' technical-impact rating directly conflicts with the C:H/I:H/A:H impact in the CVSS vector - one of these is miscalibrated and should be verified against the Ivanti advisory. There is no confirmed public exploit. Net read: this is a genuinely serious authentication-bypass/improper-access-control flaw in an internet-facing enterprise MDM appliance (the product class Ivanti EPMM belongs to has a strong history of real-world targeting), so the 'emergency' label and prompt patching are justified by pre-conditions and product exposure - but the current exploitation evidence (low EPSS, SSVC 'none', no KEV, no PoC) indicates it is not yet being exploited at scale, so the urgency is driven by potential rather than observed activity.

A remote, unauthenticated attacker reaches the internet-facing Ivanti EPMM management interface over the network and abuses the improper access control to invoke internal/arbitrary methods that should be restricted to authenticated or privileged callers, bypassing authentication entirely. Because the flaw requires no privileges, no user interaction, and low attack complexity, a single crafted network request could be sufficient. No public exploit code is identified at time of analysis, and the precise method-invocation trigger is not described in the available sources.