CVE-2026-105813: Medium severity vulnerability

Published Nov 10, 2026

Updated

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ivanti UWM to a version that resolves this vulnerability.
Fixed in 2026.4

Event History

Nov 10, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Is remote or unauthenticated exploitation indicated?

No. The vulnerability requires local access and authentication as a low-privileged user; the provided information does not indicate remote or unauthenticated exploitation.

How can I determine whether an installation is affected?

Ivanti UWM versions before 2026.4 are affected. An affected system could allow a local authenticated attacker to retrieve another local user's session token.

CVE-2026-105813: Medium severity vulnerability

Remediation

Event History

Frequently Asked Questions

Is remote or unauthenticated exploitation indicated?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Is remote or unauthenticated exploitation indicated?

How can I determine whether an installation is affected?