CVE-2026-5788: Ivanti EPMM Improper Access Control
CVE-2026-5788 is an improper access control flaw in Ivanti Endpoint Manager Mobile (EPMM) that, according to the record, lets a remote unauthenticated attacker invoke arbitrary methods. NVD scores it 9.8 (critical), and the record shows no KEV listing and no confirmed exploitation in the sources consulted. The referenced remediation is Ivanti's May 2026 security advisory.
Overview
CVE-2026-5788 is classified as CWE-284 (Improper Access Control) and affects Ivanti Endpoint Manager Mobile (EPMM). The description states that the flaw allows a remote, unauthenticated attacker to invoke arbitrary methods on the affected product.
Impact
- The NVD base score is 9.8 (critical), with a vector indicating network access, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- Other scores listed in the record are 7, provided by the CNA and another provider. Scores differ between sources, so the NVD and vendor assessments should be considered together.
- The SSVC fields in the record show exploitation as none, automatable as no, and technical impact as partial.
Affected products and versions
- Product: Ivanti Endpoint Manager Mobile (EPMM).
- The description refers to versions before 12.6.1.1, 12.7.0.1 and 12.8.0.1.
- The structured affected list states before 12.6.1.1, version 12.7.0.0 and version 12.8.0.0, and also includes an entry saying versions are not specified by the source. This differs from the description and should be verified against the vendor advisory.
Exploitation status
- The record shows KEV listed as false. No confirmed exploitation appears in the sources consulted, so this analysis does not claim active exploitation.
- The EPSS probability in the record is 0.01492, with a percentile of 0.73941.
Remediation and mitigation
- The record links a vendor patch in the Ivanti May 2026 Security Advisory. Review that advisory and apply the fixed release for each supported branch.
- Based on the description, versions before 12.6.1.1, 12.7.0.1 and 12.8.0.1 are affected. Upgrading to at least those releases on each branch is the expected path; this is an inference from the description.
- If patching is delayed, limit network exposure of EPMM management and API interfaces to trusted sources as a general defensive measure, and confirm any compensating control with the vendor.
Detection guidance
- Review EPMM access and application logs for requests from unexpected sources or unusual activity on administrative and API paths, without assuming any specific indicator has been confirmed.
- Maintain an inventory of EPMM instances and their versions to identify systems still below the fixed releases.
Limitations of the available information
- The record does not describe the affected methods, endpoints or any confirmed indicator of compromise.
- The affected version list is inconsistent between the description and the structured fields.
- The record contains no exploitation data beyond the KEV and SSVC fields.
- The EPSS date in the record (2026-10-23) is later than the publication date (2026-05-07); the EPSS values are reported as recorded.
Frequently asked questions
Is CVE-2026-5788 being actively exploited?
The record lists KEV as not listed and reports no confirmed exploitation in the sources consulted. The SSVC exploitation field is none.
Which Ivanti EPMM versions are affected?
The description refers to versions before 12.6.1.1, 12.7.0.1 and 12.8.0.1. The structured affected list differs slightly, so confirm the exact ranges in Ivanti's May 2026 advisory.
What should administrators do first?
Review the Ivanti May 2026 advisory, inventory EPMM versions, and upgrade to a fixed release for each branch. Limit exposure of management and API interfaces while patching is in progress.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.