EM
Mobile
Endpoint Manager Mobile
On CISA KEVExploited in the wildRansomware-linked
32
CVEs
8
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 17Medium 5Low 0
Watch
Add Endpoint Manager Mobile to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-4428 In wildKEV | 8.8 | May 13 | Remote Code Execution Affected: before 11.12.0.5; 12.3.0.0 before 12.3.0.2; 12.4.0.0 before 12.4.0.2; 12.5.0.0 |
| CVE-2025-4427 In wildKEV | 7.5 | May 13 | Authentication Bypass Affected: before 11.12.0.5; 12.3.0.0 before 12.3.0.2; 12.4.0.0 before 12.4.0.2; 12.5.0.0 |
| CVE-2026-6973 In wildKEV | 7.2 | May 7 | Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability Affected: before 12.6.1.1; 12.7.0.0; 12.8.0.0 |
| CVE-2023-35081 In wildKEV | 7.2 | Aug 3 | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability Affected: 11.10.0.3 before 11.10.0.3 |
| CVE-2026-18851 | 8.8 | Sep 8 | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges… Affected: before 12.8.0.4; 12.9.0.0 before 12.9.0.2; 12.10.0.0 |
| CVE-2026-5786 | 8.8 | May 7 | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access Affected: before 12.6.1.1; 12.7.0.0; 12.8.0.0 |
| CVE-2024-36131 | 8.8 | Aug 7 | An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on the underlying… Affected: before 12.1.0.1 |
| CVE-2024-7612 | 7.8 | Oct 8 | Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components Affected: before 12.0.0.5; 12.1.0.0 before 12.1.0.4 |
| CVE-2024-36132 | 7.5 | Aug 7 | Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources Affected: before 12.1.0.1 |
| CVE-2026-10727 | 7.2 | Jun 9 | An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root Affected: All versions, or not specified |
| CVE-2025-10985 | 7.2 | Oct 14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve… Affected: before 12.4.0.4; 12.5.0.0 before 12.5.0.4; 12.6.0.0 before 12.6.0.2 |
| CVE-2025-10243 | 7.2 | Oct 14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve… Affected: before 12.4.0.4; 12.5.0.0 before 12.5.0.4; 12.6.0.0 before 12.6.0.2 |
| CVE-2025-10242 | 7.2 | Oct 14 | OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve… Affected: before 12.4.0.4; 12.5.0.0 before 12.5.0.4; 12.6.0.0 before 12.6.0.2 |
| CVE-2025-6771 | 7.2 | Jul 8 | OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve… Affected: before 12.3.0.3; 12.4.0.0 before 12.4.0.3; 12.5.0.0 before 12.5.0.2 |
| CVE-2025-6770 | 7.2 | Jul 8 | OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution Affected: before 12.3.0.3; 12.4.0.0 before 12.4.0.3; 12.5.0.0 before 12.5.0.2 |
| CVE-2021-3540 | 7.2 | Jul 22 | By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core Affected: through 10.7.0.1-9; 11.0.0.0 before 11.1.0.0 |
| CVE-2021-3198 | 7.2 | Jul 22 | By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core Affected: through 10.7.0.1-9; 11.0.0.0 before 11.1.0.0 |
Showing 17