Ivanti Endpoint Manager Mobile vulnerabilities
29 vulnerabilities
Known vulnerabilities in Ivanti Endpoint Manager Mobile, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-4427ivantiendpoint_manager_mobileKEV
EPSS score99.93%
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.CVE-2025-4428ivantiendpoint_manager_mobileKEVEPSS score88.00%
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.CVE-2025-10985ivantiendpoint_manager_mobileEPSS score20.35%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2025-10986ivantiendpoint_manager_mobileEPSS score0.62%
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk.CVE-2025-10243ivantiendpoint_manager_mobileEPSS score20.35%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2025-10242ivantiendpoint_manager_mobileEPSS score20.35%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2025-6770ivantiendpoint_manager_mobileEPSS score19.53%
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code executionCVE-2025-6771ivantiendpoint_manager_mobileEPSS score23.02%
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code executionCVE-2024-36130ivantiendpoint_manager_mobile+1EPSS score2.25%
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.CVE-2024-36132ivantiendpoint_manager_mobile+1EPSS score1.25%
Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources.CVE-2024-36131ivantiendpoint_manager_mobile+1EPSS score2.29%
An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system of the appliance.CVE-2024-7612ivantiendpoint_manager_mobileEPSS score0.24%
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.CVE-2024-22026ivantiendpoint_manager_mobile+1EPSS score1.10%
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.CVE-2024-34788ivantiendpoint_manager_mobile+1EPSS score0.94%
An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive informationCVE-2026-1281ivantiendpoint_manager_mobileKEVEPSS score98.69%
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.CVE-2026-1340ivantiendpoint_manager_mobileKEVEPSS score98.64%
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.CVE-2026-7821ivantiendpoint_manager_mobileEPSS score0.86%
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.CVE-2026-18851ivantiendpoint_manager_mobileEPSS score1.03%
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.CVE-2026-5786ivantiendpoint_manager_mobileEPSS score1.21%
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.CVE-2026-5787ivantiendpoint_manager_mobileEPSS score0.85%
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.