Read the docs
TI-2026-06883 Aliases CVE-2026-7821GHSA-pr5j-p9p7-3c46

Improper certificate validation in Ivanti Endpoint Manager Mobile

Priority MEDIUM 42CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.

Summary

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00509 43rd percentileScored 2026-11-07
Fix Fixed Endpoint Manager Mobile (Ivanti): 12.6.1.1, 12.7.0.1, 12.8.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiEndpoint Manager Mobile—12.6.1.1, 12.7.0.1, 12.8.0.1Patch availableCNA
  • Endpoint Manager Mobile VendorIvanti Affected — Fixed in 12.6.1.1, 12.7.0.1, 12.8.0.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*before 12.6.1.1VulnerableIvanti
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*12.7.0.0VulnerableIvanti
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:*12.8.0.0VulnerableIvanti
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* Versions before 12.6.1.1 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:* Versions 12.7.0.0 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:* Versions 12.8.0.0 Vulnerable ·Ivanti

Remediation

  • Fix · CNA Endpoint Manager Mobile (Ivanti) Fixed in 12.6.1.1, 12.7.0.1, 12.8.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7821
  2. 2026-10-03 Alias added: GHSA-pr5j-p9p7-3c46
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

  • TI-2026-01051 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-00997 A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17552 Improper authentication in Ivanti EPMM KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-17549 Improper authentication in Ivanti Endpoint Manager Mobile KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-03948 Remote code execution in Ivanti Endpoint Manager Mobile KEVCVSS 3.1HIGH 8.8
  • TI-2025-03947 Authentication bypass in Ivanti Endpoint Manager Mobile KEVCVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences