Endpoint Manager Mobile (Ivanti) - vulnerabilities (CVEs)

29 CVEs, 0 in the last 30 days, 84 known versions, newest CVE from 2026-09-08. Vendor: Ivanti.

CVEs of Endpoint Manager Mobile

CVE-2026-18851 - CVSS 8.8 (high), 2026-09-08: Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate…
CVE-2026-10727 - CVSS 7.2 (high), 2026-06-09: An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute…
CVE-2026-6973 - CVSS 7.2 (high), 2026-05-07: An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access…
CVE-2026-7821 - CVSS 9.1 (critical), 2026-05-07: Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device…
CVE-2026-5786 - CVSS 8.8 (high), 2026-05-07: An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain…
CVE-2026-5788 - CVSS 9.8 (critical), 2026-05-07: An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
CVE-2026-5787 - CVSS 9.1 (critical), 2026-05-07: An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate…
CVE-2026-1340 - CVSS 9.8 (critical), 2026-01-29: A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2026-1281 - CVSS 9.8 (critical), 2026-01-29: A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVE-2025-10985 - CVSS 7.2 (high), 2025-10-14: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin…
CVE-2025-10243 - CVSS 7.2 (high), 2025-10-14: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin…
CVE-2025-10242 - CVSS 7.2 (high), 2025-10-14: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin…
CVE-2025-10986 - CVSS 5.5 (medium), 2025-10-14: Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges…
CVE-2025-6771 - CVSS 7.2 (high), 2025-07-08: OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high…
CVE-2025-6770 - CVSS 7.2 (high), 2025-07-08: OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve…
CVE-2025-4427 - CVSS 7.5 (high), 2025-05-13: An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without…
CVE-2025-4428 - CVSS 8.8 (high), 2025-05-13: Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute…
CVE-2024-7612 - CVSS 8.8 (high), 2024-10-08: Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.
CVE-2024-36131 - CVSS 8.8 (high), 2024-08-07: An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on…
CVE-2024-36132 - CVSS 8.2 (high), 2024-08-07: Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources.
CVE-2024-36130 - CVSS 9.8 (critical), 2024-08-07: An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary…
CVE-2024-34788 - CVSS 6.5 (medium), 2024-08-07: An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information
CVE-2023-46807 - CVSS 6.7 (medium), 2024-05-22: An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in…
CVE-2023-46806 - CVSS 6.7 (medium), 2024-05-22: An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify…
CVE-2024-22026 - CVSS 6.7 (medium), 2024-05-22: A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary…
CVE-2023-39335 - CVSS 9.8 (critical), 2023-11-15: A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any…
CVE-2023-39337 - CVSS 9.1 (critical), 2023-11-15: A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and…
CVE-2023-35082 - CVSS 10 (critical), 2023-08-15: An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the…
CVE-2023-35081 - CVSS 7.2 (high), 2023-08-03: A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to…
CVE-2023-35078 - CVSS 10 (critical), 2023-07-25: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without…