Ivanti EPMM EUVD-2026-35444

Exploitation requires authenticated access to the Ivanti EPMM management interface with high administrative privileges (CVSS PR:H), no user interaction, and network reachability to the EPMM server (AV:N, AC:L). Limiting factors: an attacker must already possess valid high-privilege EPMM admin credentials or chain this with a separate authentication or privilege-escalation flaw; defenders who isolate the EPMM admin interface from untrusted networks and enforce MFA on admin accounts substantially reduce realistic exposure. The vulnerability affects EPMM at versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2 regardless of specific feature toggles, so the precondition is administrative authentication rather than a non-default configuration.

CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network reach with low complexity and no user interaction but requires high privileges, which is the dominant risk-limiting factor. Exploitation status is no public exploit identified at time of analysis and the CVE is not in CISA KEV, and no EPSS score was provided in the input. The signals are internally consistent: a post-authentication root command execution is serious but not a mass-exploitation candidate unless paired with a separate authentication bypass - a pattern Ivanti EPMM has seen before, which is why this should be prioritized for patching even though the standalone score suggests moderate urgency.

An attacker who has obtained or compromised a high-privilege EPMM administrator credential - for example, through phishing, credential reuse, or chaining with a separate authentication bypass - sends a crafted request to a vulnerable EPMM endpoint that injects shell metacharacters into a parameter passed to an OS command. The injected command executes as root on the EPMM appliance, giving the attacker full control of the device management server, its enrolled-device data, and any stored MDM secrets. No public exploit identified at time of analysis, but the simplicity of OS command injection bugs typically makes reproduction straightforward once the vulnerable parameter is identified.