November 2026 Security Advisory Ivanti EPMM (Multiple CVEs)

Ivanti has released updates for Ivanti Endpoint Manager Mobile (EPMM) which addresses one high severity vulnerability and five medium severity vulnerabilities.

We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure.

Vulnerability Details:

CVSS Score (Severity)

OS command injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS:3.1 /AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Ivanti Endpoint Manager Mobile (EPMM)

Download Portal (Login Required) See detailed instructions below.

Customers should update their solution to one of the fixed versions of Ivanti Endpoint Manager Mobile (EPMM). The new versions can be found at the following links.

ISO

Update

ISO

Update

ISO

Update

Ivanti would like to thank the following for reporting the relevant issues and for working with Ivanti to help protect our customers:

btaol of Aquila Sec Lab (CVE-2026-105425)

btaol of Aquila Sec Lab (CVE-2026-105425)

Anonymous member from the Ivanti Bug Bounty Program (CVE-2026-83528)

Are you aware of any active exploitation of these vulnerabilities? We are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program .

Are you aware of any active exploitation of these vulnerabilities? We are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program .

How can I tell if I have been compromised? Currently, there is no known public exploitation of this vulnerability that could be used to provide a list of indicators of compromise.

How can I tell if I have been compromised? Currently, there is no known public exploitation of this vulnerability that could be used to provide a list of indicators of compromise.

What should I do if I need help? If you have questions after reviewing this information, you can log a case and/or request a call via the Ivanti Innovators Hub.

What should I do if I need help? If you have questions after reviewing this information, you can log a case and/or request a call via the Ivanti Innovators Hub.