Ivanti EPMM EUVD-2026-28397

Exploitation requires network access to an unpatched Ivanti EPMM appliance (before 12.6.1.1, 12.7.0.1, or 12.8.0.1) and abuse of improper certificate validation in the device-enrollment flow; no authentication, privileges, or user interaction are required (PR:N/UI:N). The key limiting factor stated in the description is that the attacker can only enroll a device 'belonging to a restricted set of unenrolled devices' - not arbitrary devices - which constrains this to targeted scenarios and is consistent with SSVC Automatable: no. Remaining risk is bounded to confidentiality and integrity (appliance information disclosure and forged/compromised new-device identity); there is no availability impact. Per the vendor, updating to the fixed versions is the remediation.

Signals are mixed and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, yielding a 9.1 'Critical' score with high confidentiality and integrity impact and no availability impact - consistent with a pre-authentication enrollment weakness. However, the exploitation-likelihood signals are notably cooler: EPSS is only 0.04% (14th percentile), the CVE is NOT in CISA KEV, and no public exploit or PoC reference is provided. The CISA SSVC framing reinforces this nuance - Exploitation: none (no observed or public exploitation), Automatable: no (it cannot be reliably mass-exploited/scripted against many targets), yet Technical Impact: total. The vuln.today 'emergency' decision label therefore appears driven by the critical CVSS and unauthenticated network reachability of a security appliance rather than by observed exploitation, and it directly conflicts with the low EPSS and SSVC 'Exploitation: none / Automatable: no' signals - treat 'emergency' as a patch-prioritization recommendation for an exposed MDM appliance, not as confirmation of active or widespread attacks. A further caveat: the description constrains exploitation to enrolling a device 'belonging to a restricted set of unenrolled devices,' which implies targeted, precondition-dependent abuse rather than opportunistic scanning - aligning with SSVC Automatable: no. Net: a genuinely serious, patch-worthy flaw on an internet-facing appliance, but current evidence points to targeted rather than mass exploitation, and no exploitation has been confirmed.

A remote, unauthenticated attacker who can reach an unpatched EPMM appliance over the network exploits the improper certificate validation during device enrollment to enroll a device that falls within a restricted set of otherwise-unenrolled devices. This leaks information about the EPMM appliance and corrupts the integrity of the newly enrolled device identity. No public exploit or PoC is identified at time of analysis, and the attack is constrained to targeting devices in that restricted set rather than arbitrary mass enrollment.