Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-105427

Admin input validation DoS in Ivanti EPMM before patched builds

CVSS 3.1
4.9 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-105427 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Improper input validation in Ivanti Endpoint Manager Mobile (EPMM) lets a remote attacker who already has administrator privileges permanently disable all Apache HTTPS services, causing a denial of service. No user interaction is required. Deployments running EPMM before 12.10.0.1, 12.9.0.3, and 12.8.0.5 are affected.

What to do: Upgrade Ivanti EPMM to 12.10.0.1, 12.9.0.3, or 12.8.0.5, matching the installed release line.

ProductAffectedFixed in
Ivanti EPMMbefore 12.10.0.1, 12.9.0.3, and 12.8.0.512.10.0.1, 12.9.0.3, and 12.8.0.5
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

Weakness
CWE-20
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories