Login Request a demo
EM
Mobile
Endpoint Manager Mobile
by Ivanti · last CVE Sep 8, 2026
On CISA KEVExploited in the wildRansomware-linked
32
CVEs
8
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities32In the news10Timeline
Severity mix
Critical 10High 17Medium 5Low 0
Severity
All severities32Critical10High17Medium5Low0
Exploitation
On CISA KEV8Exploited in the wild8
Watch

Add Endpoint Manager Mobile to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-1340
In wildKEV
9.8
99%
Jan 29
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Affected: through 12.7.0.0
CVE-2026-1281
In wildKEV
9.8
99%
Jan 29
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Affected: through 12.5.0.0; 12.5.1.0; 12.6.0.0; 12.6.1.0; 12.7.0.0
CVE-2023-35082
RansomwareIn wildKEV
9.8
100%
Aug 15
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Affected: 11.10 through 11.10
CVE-2023-35078
RansomwareIn wildKEV
9.8
100%
Jul 25
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Affected: before 11.8.1.1; 11.9.0 before 11.9.1.1; 11.10 before 11.10.0.2
CVE-2025-4428
In wildKEV
8.8
88%
May 13
Remote Code Execution
Affected: before 11.12.0.5; 12.3.0.0 before 12.3.0.2; 12.4.0.0 before 12.4.0.2; 12.5.0.0
CVE-2025-4427
In wildKEV
7.5
100%
May 13
Authentication Bypass
Affected: before 11.12.0.5; 12.3.0.0 before 12.3.0.2; 12.4.0.0 before 12.4.0.2; 12.5.0.0
CVE-2026-6973
In wildKEV
7.2
34%
May 7
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Affected: before 12.6.1.1; 12.7.0.0; 12.8.0.0
CVE-2023-35081
In wildKEV
7.2
64%
Aug 3
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
Affected: 11.10.0.3 before 11.10.0.3
CVE-2026-5788
9.8
1%
May 7
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods
Affected: before 12.6.1.1; 12.7.0.0; 12.8.0.0
CVE-2024-36130
9.8
2%
Aug 7
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the…
Affected: before 12.1.0.1
CVE-2023-39335
9.8
2%
Nov 15
A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the…
Affected: before 11.9.0; 11.10.0 before 11.10.0.4; 11.11.0 before 11.11.0.2
CVE-2026-5787
9.1
1%
May 7
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts…
Affected: before 12.6.1.1; 12.7.0.0; 12.8.0.0
CVE-2026-7821
9.1
1%
May 7
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a…
Affected: before 12.6.1.1; 12.7.0.0; 12.8.0.0
CVE-2023-39337
9.1
2%
Nov 15
A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive…
Affected: through 11.9.0; 11.10.0 before 11.10.0.4; 11.11.0 before 11.11.0.2
CVE-2026-18851
8.8
1%
Sep 8
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges…
Affected: before 12.8.0.4; 12.9.0.0 before 12.9.0.2; 12.10.0.0
CVE-2026-5786
8.8
11%
May 7
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access
Affected: before 12.6.1.1; 12.7.0.0; 12.8.0.0
CVE-2024-36131
8.8
2%
Aug 7
An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on the underlying…
Affected: before 12.1.0.1
CVE-2024-7612
7.8
0%
Oct 8
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components
Affected: before 12.0.0.5; 12.1.0.0 before 12.1.0.4
CVE-2024-36132
7.5
1%
Aug 7
Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources
Affected: before 12.1.0.1
CVE-2026-10727
7.2
14%
Jun 9
An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root
Affected: All versions, or not specified
CVE-2025-10985
7.2
20%
Oct 14
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve…
Affected: before 12.4.0.4; 12.5.0.0 before 12.5.0.4; 12.6.0.0 before 12.6.0.2
CVE-2025-10243
7.2
20%
Oct 14
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve…
Affected: before 12.4.0.4; 12.5.0.0 before 12.5.0.4; 12.6.0.0 before 12.6.0.2
CVE-2025-10242
7.2
20%
Oct 14
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve…
Affected: before 12.4.0.4; 12.5.0.0 before 12.5.0.4; 12.6.0.0 before 12.6.0.2
CVE-2025-6771
7.2
23%
Jul 8
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve…
Affected: before 12.3.0.3; 12.4.0.0 before 12.4.0.3; 12.5.0.0 before 12.5.0.2
CVE-2025-6770
7.2
20%
Jul 8
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution
Affected: before 12.3.0.3; 12.4.0.0 before 12.4.0.3; 12.5.0.0 before 12.5.0.2
CVE-2021-3540
7.2
3%
Jul 22
By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core
Affected: through 10.7.0.1-9; 11.0.0.0 before 11.1.0.0
CVE-2021-3198
7.2
3%
Jul 22
By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core
Affected: through 10.7.0.1-9; 11.0.0.0 before 11.1.0.0
CVE-2024-22026
6.7
1%
May 22
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance
Affected: before 12.1.0.0
CVE-2023-46807
6.7
1%
May 22
An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database
Affected: before 12.1.0.0
CVE-2023-46806
6.7
1%
May 22
An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the…
Affected: before 12.1.0.0
CVE-2024-34788
6.5
1%
Aug 7
An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information
Affected: before 12.1.0.1
CVE-2025-10986
5.5
1%
Oct 14
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in…
Affected: before 12.4.0.4; 12.5.0.0 before 12.5.0.4; 12.6.0.0 before 12.6.0.2
Showing 32