Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-105426

Input validation flaw in Ivanti EPMM (admin)

CVSS 3.1
6.7 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-105426 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Improper input validation in Ivanti Endpoint Manager Mobile (EPMM) lets a remote authenticated administrator set arbitrary Linux kernel parameters as root. No user interaction is required. Integrity and availability impact is high, with limited confidentiality impact. EPMM installs before 12.10.0.1, 12.9.0.3, and 12.8.0.5 are affected.

What to do: Upgrade Ivanti EPMM to 12.10.0.1, 12.9.0.3, or 12.8.0.5, matching the installed release line.

ProductAffectedFixed in
Ivanti Endpoint Manager Mobile (EPMM)before 12.10.0.1, 12.9.0.3, and 12.8.0.512.10.0.1, 12.9.0.3, and 12.8.0.5
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

Weakness
CWE-20
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories