CVE Intelligence
Analysis AI-assisted

CVE-2026-5787: Ivanti EPMM Improper Certificate Validation

CVE-2026-5787 is an improper certificate validation flaw (CWE-295) in Ivanti Endpoint Manager Mobile (EPMM). According to the record, a remote unauthenticated attacker could impersonate registered Sentry hosts and obtain valid CA-signed client certificates. NVD lists a CVSS 3.1 base score of 9.1, and the CVE is not listed in CISA KEV; no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-5787 affects Ivanti Endpoint Manager Mobile (EPMM). The weakness is classified as CWE-295, Improper Certificate Validation. The record states that the flaw allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.

Impact

  • The record describes impersonation of registered Sentry hosts and acquisition of valid CA-signed client certificates.
  • NVD scores the issue at CVSS 3.1 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which indicates network access, no privileges and no user interaction, with high confidentiality and integrity impact.
  • Another provider in the record lists 8.9 under CVSS 3.1, and Ivanti is listed as a provider with 8.9.
  • The SSVC data in the record reports technical impact as total and automatable as no.

Affected products and versions

  • Product: Ivanti Endpoint Manager Mobile (EPMM).
  • The record indicates versions before 12.6.1.1 are affected, along with 12.7.0.0 and 12.8.0.0.
  • The description names 12.6.1.1, 12.7.0.1 and 12.8.0.1 as the versions in which the issue is addressed.
  • The record also notes that not all affected versions are specified by the source, so the complete range should be confirmed with the vendor advisory.

Exploitation status

  • The CISA KEV entry is not listed for this CVE in the record.
  • The SSVC exploitation field is none.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.00851 with a percentile of 0.57817, as recorded in the data provided.

Remediation and mitigation

  • The vendor references a patch in the Ivanti security advisory for May 2026 covering multiple EPMM CVEs.
  • Organizations running EPMM should review the advisory, confirm their installed version, and apply the vendor fix for their release line.
  • Until patching is complete, administrators should review certificate trust and Sentry registration controls in line with vendor guidance.

Detection guidance

  • Review EPMM and Sentry logs for unexpected client certificate issuance or enrollment activity.
  • Monitor for unusual connections or certificate requests from hosts that are not expected Sentry components.
  • Correlate findings with the vendor advisory before drawing conclusions, since the record does not provide detailed indicators.

Limitations of the available information

  • The record does not describe the technical details of the flaw, and this analysis does not include them.
  • The complete list of affected versions is not specified in the record.
  • The EPSS date in the record is later than the publication date, so the EPSS values should be treated with caution.
  • The vendor advisory was not reviewed beyond the URL recorded in the data.

Frequently asked questions

What does CVE-2026-5787 allow?

According to the record, a remote unauthenticated attacker could impersonate registered Sentry hosts and obtain valid CA-signed client certificates in Ivanti EPMM.

Is CVE-2026-5787 listed in CISA KEV?

No. The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Review the Ivanti May 2026 security advisory, confirm the installed EPMM version, and apply the vendor patch for the affected release line.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.