CVE-2024-29847

CVE-2024-29847 Ivanti Endpoint Manager AgentPortal 不可信数据反序列化远程代码执行漏洞 CVE-2024-29847 的 PoC 该漏洞的根因分析可在我的博客中找到： https://summoning.team/blog/ivanti-epm-CVE-2024-29847-deserialization-RCE/ 用法 CVE-2024-29847.exe --uselease --installdir "C:\Program...

Ivanti Endpoint Manager - Authentication Bypass

Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...

Ivanti EPMM < 12.8.0.0 - Remote Code Execution

Ivanti Endpoint Manager Mobile contains a code injection vulnerability allowing unauthenticated attackers to execute arbitrary code remotely, exploit requires no authentication. id: CVE-2026-1340 info: name: Ivanti EPMM 12.8.0.0 - Remote Code Execution author: 0xAkoko severity: critical...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...

The vulnerability of the software management console for endpoints, Ivanti Endpoint Manager, allows a hacker to execute arbitrary code.

The vulnerability of the Ivanti Endpoint Manager software control console relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Endpoint Manager Mobile < 12.8.0.4 / 12.9.x < 12.9.0.2 / 12.10.0.0 Privilege Escalation (CVE-2026-18851)

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is prior to 12.8.0.4, or 12.9.x prior to 12.9.0.2. It is, therefore, affected by a privilege escalation vulnerability: - Missing authorization in Ivanti Endpoint Manager Mobile before version...

Vulnerability handling in Ivanti Endpoint Manager Mobile

Ivanti has identified a vulnerability in Ivanti Endpoint Manager Mobile. This vulnerability relates to the lack of authentication control in versions of Ivanti Endpoint Manager Mobile older than 12.10.0.0, 12.9.0.2, and 12.8.0.4. As a result, authenticated users may be able to elevate their...

CVE-2026-18851

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...

CVE-2026-18851

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...

EUVD-2026-72792

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...

CVE-2026-18851

CVE-2026-18851 is a missing authorization vulnerability in Ivanti Endpoint Manager Mobile affecting versions before 12.10.0.0 , 12.9.0.2 , and 12.8.0.4 . The flaw allows a remote authenticated attacker to escalate privileges to admin , resulting in high impact on confidentiality, integrity, and a...

CVE-2026-18851

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...

Security Advisory - Ivanti Endpoint Manager Mobile (CVE-2026-18851)

Summary Ivanti has released updates for Ivanti Endpoint Manager Mobile EPMM which addresses one high severity vulnerability. Successful exploitation could lead to privilege escalation. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability...

CVE-2026-18851: Missing Authorization

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...

PT-2026-87092

Ivanti Patches 10 Flaws Across EPMM, Neurons ITSM and Sentry Including Unauthenticated RCE https://t.co/gNAWhXgUsO "The EPMM advisory addresses CVE-2026-18851, a high-severity missing authorization vulnerability with a CVSS score of 8.8. Classified as CWE-862…"...

Ivanti Endpoint Manager < 2024 SU7 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager running on the remote host is prior to 2024 SU7. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent servic...

CVE-2026-18125

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service...

CVE-2026-18127

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...