Endpoint Manager Mobile at a glance
1 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 6 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 1 | 0 |
| May 2026 | 5 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 2 | 2 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 4 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 2 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 2 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Latest advisories
-
Medium max 7.2WID-SEC-2026-4513 6 CVEs
Ivanti Endpoint Manager Mobile: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager Mobile ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren oder Informationen auszulesen.
-
High max 8.8NCSC-2026-0359 1 CVE
Kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobile
Ivanti heeft een kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobile.
-
High max 8.8WID-SEC-2026-3270 1 CVE
Ivanti Endpoint Manager Mobile: Schwachstelle ermöglicht Erlangen von Administratorrechten
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Ivanti Endpoint Manager Mobile ausnutzen, um Administratorrechte zu erlangen.
-
Medium max 7.2
Ivanti Endpoint Manager Mobile: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager Mobile ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.
-
High max 8.9
Ivanti Endpoint Manager Mobile: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager Mobile ausnutzen, um Administratorrechte zu erlangen, beliebigen Code mit Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informatio…
first May 7, 2026
25 results · Feed
-
Medium 4.9
Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker…
-
Medium 5.5
An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authentic…
-
Medium 4.9
Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attac…
-
Medium 4.9
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
Medium 6.7
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticate…
-
High 7.2CVE-2026-105425 Public exploit
OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versi…
-
High 8.8
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remot…
-
High 7.2CVE-2026-10727 EPSS 13%
An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote au…
-
High 8.9
An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unau…
-
High 7.0
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthentica…
-
High 7.4
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthe…
-
High 7.2
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenti…
KEV May 7, 2026 -
High 8.8CVE-2026-5786 EPSS 11%
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remot…
-
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Apr 8, 2026 -
Critical 9.8
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KEV Jan 29, 2026 -
Medium 4.7
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authen…
-
High 7.2CVE-2025-10985 EPSS 21%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote …
-
High 7.2CVE-2025-10243 EPSS 21%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote …
-
High 7.2CVE-2025-10242 EPSS 21%
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote …
-
High 7.2CVE-2025-6771 EPSS 23%
OS command injection in Ivanti Endpoint Manager
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution
-
High 7.2CVE-2025-6770 EPSS 20%
OS command injection in Ivanti Endpoint Manager
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution
-
High 7.2
Remote Code Execution
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
KEV May 19, 2025 -
Medium 5.3
Authentication Bypass
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
KEV May 19, 2025 -
High 8.8
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive applicatio…
-
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or r…
KEV Jul 25, 2023