CVE-2024-22026

—

CVSS 3.1

6.7 medium

EPSS

1%p64

Published

May 22, 2024 (May 22, 2024)

Modified

Jun 17, 2026

Description

A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.

Vendors: ivanti
Products: endpoint manager mobile
Weakness: CWE-284
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news3 stories

Week in review: Google fixes yet another Chrome zero-day exploit, YouTube as a cybercrime channel

Help Net SecurityMay 26, 00:00 UTC · May 26, 2024Exploit / PoC in the wildCVE-2024-5274 CVE-2024-4985 CVE-2023-43208+4 CVEs

PoC exploit for Ivanti EPMM privilege escalation flaw released (CVE 2024-22026)

Help Net SecurityMay 20, 00:00 UTC · May 20, 2024Exploit / PoC CVE-2024-22026 CVE-2023-46806 CVE-2023-46807

CISA Warns of Actively Exploited D-Link Router Vulnerabilities

The Hacker NewsMay 17, 11:23 UTC · May 17, 2024Vulnerability in the wildCVE-2014-100005 CVE-2021-40655 CVE-2024-22026+2 CVEs