CVE-2026-5787

nvd.nist.gov • May 8, 2026

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Ivanti EPMM Expose Systems to Remote Attacks Two critical vulnerabilities (CVE-2026-5787 and CVE-2026-5788) were disclosed in Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. CVE-2026-5787 allows attackers to impersonate Sentry hosts and obtain valid CA-signed client certificates, while CVE-2026-5788 enables unauthorized method invocation. Both vulnerabilities can be exploited by remote unauthenticated attackers, posing significant risks to affected systems. The vulnerabilities were published on May 7, 2026, and are currently unpatched. Organizations using vulnerable versions of Ivanti EPMM are advised to take immediate action to mitigate potential exploitation. 72

Extracted Entities

CVE-2026-5787

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)