CVE-2026-105426: Input Validation

Published Nov 10, 2026

Updated

Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ivanti EPMM to a version that resolves this vulnerability.
Fixed in 12.10.0.1
Upgrade
Upgrade Ivanti EPMM to a version that resolves this vulnerability.
Fixed in 12.9.0.3
Upgrade
Upgrade Ivanti EPMM to a version that resolves this vulnerability.
Fixed in 12.8.0.5

Event History

Nov 10, 2026

CVE Published

via MITRE·03:54 PM

Data Sourced

via MITRE·03:54 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access would an attacker need before they could exploit this issue?

The attacker must be remotely authenticated and already hold administrator privileges in Ivanti EPMM. No user interaction is required.

Which Ivanti EPMM versions include the fix?

The issue is fixed in Ivanti EPMM 12.10.0.1, 12.9.0.3, and 12.8.0.5. Versions earlier than those releases are affected.

CVE-2026-105426: Input Validation

Remediation

Event History

Frequently Asked Questions

What access would an attacker need before they could exploit this issue?

Which Ivanti EPMM versions include the fix?

Company

Resources

Contact

Frequently Asked Questions

What access would an attacker need before they could exploit this issue?

Which Ivanti EPMM versions include the fix?