This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Ivanti EPMM fixes 5 high-severity vulnerabilities
Ivanti fixes 5 vulnerabilities in Ivanti Endpoint Manager Mobile with versions 12.6.1.1, 12.7.0.1 and 12.8.0.1, one of which is being actively exploited [1].
An authenticated remote attacker with administrator privileges is able to execute arbitrary code due to insufficient input validation. This vulnerability is already being actively exploited [1].
The vulnerability is present in product:
- Ivanti Endpoint Manager Mobile; < 12.6.1.1; >= 12.7.0.0, < 12.7.0.1; >= 12.8.0.0, < 12.8.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-6973 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 7. 5. 2026.
An unauthenticated remote attacker is able to impersonate registered Sentry hosts and obtain valid client certificates signed by the certificate authority due to improper certificate validation [1].
The vulnerability is present in product:
- Ivanti Endpoint Manager Mobile; < 12.6.1.1; >= 12.7.0.0, < 12.7.0.1; >= 12.8.0.0, < 12.8.0.1
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
More information:
- CVE-2026-5787 at cve.org, NVD
- CWE-295: Improper certificate validation at cwe.mitre.org
The vulnerability was publicly disclosed 7. 5. 2026.
An authenticated remote attacker with low privileges is able to gain full administrative access to the system due to improper access control [1].
The vulnerability is present in product:
- Ivanti Endpoint Manager Mobile; < 12.6.1.1; >= 12.7.0.0, < 12.7.0.1; >= 12.8.0.0, < 12.8.0.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-5786 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 7. 5. 2026.
By CESNET, z.s.p.o. Henrieta Paločková on 11. 5. 2026.