CVE-2026-18851
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Missing authorization in Ivanti Endpoint Manager Mobile before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
Risk Assessment
An attacker with basic access can gain full control over the system, potentially leading to data confidentiality and integrity breaches and compromise of mobile device management.
Recommendation
It is recommended to immediately update Ivanti Endpoint Manager Mobile to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Ivanti Endpoint Manager Mobile
See all- CVE-2026-1281CriticalActively exploited
Code injection vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
- CVE-2025-4428HighActively exploited
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
Original NVD description (English source)
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.