CVE-2026-7821

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.51%
EPSS Percentile: 43.52%
CISA KEV: Not listed

Description

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Published: 07-May-2026 23:16
Last Modified: 27-Oct-2026 03:10
EPSS Date: 2026-11-03
CWE: CWE-295

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

CNA Products / Version Status

Ivanti · Endpoint Manager Mobile Source: CNA · 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Default status: affected

12.6.1.1 — unaffected
12.7.0.1 — unaffected
12.8.0.1 — unaffected

Affected Products / Versions

ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 12.6.1.1
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*
ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: 12.7.0.0
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*
ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: 12.8.0.0
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:*

References

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Last enrichment sync: 04-Nov-2026 11:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

These security holes are tracked as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788 and CVE-2026-7821, and they can be exploited for privilege escalation, obtaining client certificates, invoking arbitrary methods, and Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks
Thursday, including the four additional defects — CVE-2026-5787, CVE-2026-5788, CVE-2026-6973 and CVE-2026-7821 — which it said haven’t been exploited in the wild. Ivanti Patches Actively Exploited EPMM Zero-Day Requiring Admin Access
four other high-severity EPMM vulnerabilities (CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821) that can allow attackers to gain admin access, impersonate registered Sentry hosts to obtain valid Ivanti Patches EPMM Zero-Day RCE Exploited in Limited Attacks

CVE (6)

People (2)

Vendors (1)

Products (1)

Industries (2)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.