Ivanti Endpoint Manager Mobile — known CVE vulnerabilities

Every CVE whose affected-product data names Ivanti Endpoint Manager Mobile, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (28)

• CVE-2026-1281 — CVSS 9.8 (critical) — actively exploited: A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
• CVE-2024-36130 — CVSS 9.8 (critical): An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network…
• CVE-2023-35082 — CVSS 9.8 (critical) — actively exploited: An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or…
• CVE-2023-39335 — CVSS 9.8 (critical): A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to…
• CVE-2023-35078 — CVSS 9.8 (critical) — actively exploited: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the…
• CVE-2026-1340 — CVSS 9.8 (critical) — actively exploited: A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
• CVE-2023-39337 — CVSS 9.1 (critical): A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier…
• CVE-2026-5787 — CVSS 8.9 (high): An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker…
• CVE-2024-7612 — CVSS 8.8 (high): Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.
• CVE-2026-5786 — CVSS 8.8 (high): An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated…
• CVE-2024-36131 — CVSS 8.8 (high): An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute…
• CVE-2024-36132 — CVSS 7.5 (high): Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access…
• CVE-2026-7821 — CVSS 7.4 (high): Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to…
• CVE-2023-35081 — CVSS 7.2 (high) — actively exploited: A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an…
• CVE-2025-10243 — CVSS 7.2 (high): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated…
• CVE-2025-10985 — CVSS 7.2 (high): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated…
• CVE-2025-4428 — CVSS 7.2 (high) — actively exploited: Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated…
• CVE-2025-6770 — CVSS 7.2 (high): OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high…
• CVE-2025-6771 — CVSS 7.2 (high): OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated…
• CVE-2026-6973 — CVSS 7.2 (high) — actively exploited: An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with…
• CVE-2025-10242 — CVSS 7.2 (high): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated…
• CVE-2026-5788 — CVSS 7.0 (high): An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to…
• CVE-2023-46806 — CVSS 6.7 (medium): An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege…
• CVE-2024-22026 — CVSS 6.7 (medium): A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and…
• CVE-2023-46807 — CVSS 6.7 (medium): An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access…
• CVE-2024-34788 — CVSS 6.5 (medium): An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially…
• CVE-2025-4427 — CVSS 5.3 (medium) — actively exploited: An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected…
• CVE-2025-10986 — CVSS 4.7 (medium): Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker…