VIR Vulnerability Intelligence Relay

CVE-2026-5788

critical
Published 2026-05-07 · Modified 2026-05-07
CVSS v3
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
—
VIR risk
9.8

Description

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 — https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs

Application impact
VendorProductVersionsFixed
ivantiendpoint_manager_mobile{"endExcluding":"12.6.1.1"}12.6.1.1
ivantiendpoint_manager_mobile12.7.0.0
ivantiendpoint_manager_mobile12.8.0.0

References

CWEs

CWE-284

Verify integrity in audit chain (admin only). AS-IS.