Vulnerabilidades do Ivanti Endpoint Manager Mobile
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Ivanti Endpoint Manager Mobile: 18 registro(s), com versões afetadas e correções.cpe:2.3:a:ivanti:endpoint_manager_mobile
CVE-2026-18851
Alta · 8.8
CWE-862 08/09/2026
Missing Authorization em Ivanti Endpoint Manager Mobile
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
CVE-2026-10727
Alta · 7.2
CWE-78 09/06/2026
OS Command Injection em Ivanti Endpoint Manager Mobile
An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root
CVE-2026-7821
Crítica · 9.1
CWE-295 07/05/2026
Improper Certificate Validation em Ivanti Endpoint Manager Mobile
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.
CVE-2026-6973
Alta · 7.2
KEV Alta · 54 CWE-20 07/05/2026
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
CVE-2026-5788
Crítica · 9.8
CWE-284 07/05/2026
Improper Access Control em Ivanti Endpoint Manager Mobile
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
CVE-2026-5787
Crítica · 9.1
CWE-295 07/05/2026
Improper Certificate Validation em Ivanti Endpoint Manager Mobile
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
CVE-2026-5786
Alta · 8.8
CWE-284 07/05/2026
Improper Access Control em Ivanti Endpoint Manager Mobile
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
CVE-2026-1281
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-94 29/01/2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2026-1340
Crítica · 9.8
KEV Urgente · 79 Exploit público CWE-94 29/01/2026
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2025-10986
Média · 5.5
CWE-22 14/10/2025
Path Traversal em Ivanti Endpoint Manager Mobile
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk.
CVE-2025-10985
Alta · 7.2
CWE-78 14/10/2025
OS Command Injection em Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-10243
Alta · 7.2
CWE-78 14/10/2025
OS Command Injection em Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-10242
Alta · 7.2
CWE-78 14/10/2025
OS Command Injection em Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-4427
Alta · 7.5
KEV Urgente · 79 Exploit público CWE-288 13/05/2025
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
CVE-2025-4428
Alta · 8.8
KEV Urgente · 77 Exploit público CWE-94 13/05/2025
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
CVE-2023-35082
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-287 15/08/2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2023-35081
Alta · 7.2
KEV Alta · 56 CWE-22 03/08/2023
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
CVE-2023-35078
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-287 25/07/2023
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.