CVE-2026-5787

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.69%
EPSS Percentile: 52.71%
CISA KEV: Not listed

Description

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Published: 07-May-2026 23:16
Last Modified: 26-Oct-2026 07:10
EPSS Date: 2026-11-03
CWE: CWE-295

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

CNA Products / Version Status

Ivanti · Endpoint Manager Mobile Source: CNA · 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Default status: affected

12.8.0.1 — unaffected (custom)
12.7.0.1 — unaffected (custom)
12.6.1.1 — unaffected (custom)

Affected Products / Versions

ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 12.6.1.1
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*
ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: 12.7.0.0
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*
ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: 12.8.0.0
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:*

References

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Last enrichment sync: 04-Nov-2026 10:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

These security holes are tracked as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788 and CVE-2026-7821, and they can be exploited for privilege escalation, obtaining client certificates, invoking arbitrary methods, and Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks
released patches for all five vulnerabilities Thursday, including the four additional defects — CVE-2026-5787, CVE-2026-5788, CVE-2026-6973 and CVE-2026-7821 — which it said haven’t been exploited in the wild. Ivanti Patches Actively Exploited EPMM Zero-Day Requiring Admin Access
âToday, Ivanti also patched four other high-severity EPMM vulnerabilities (CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821) that can allow attackers to gain admin access, impersonate registered Sentry Ivanti Patches EPMM Zero-Day RCE Exploited in Limited Attacks

CVE (6)

People (2)

Vendors (1)

Products (1)

Industries (2)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.