CVE-2026-107405: Medium severity vulnerability

Published Nov 10, 2026

Updated

An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of service.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ivanti EPMM to a version that resolves this vulnerability.
Fixed in 12.10.0.1
Upgrade
Upgrade Ivanti EPMM to a version that resolves this vulnerability.
Fixed in 12.9.0.3
Upgrade
Upgrade Ivanti EPMM to a version that resolves this vulnerability.
Fixed in 12.8.0.5

Event History

Nov 10, 2026

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires a local attacker who is already authenticated. The issue is not described as remotely exploitable.

Which Ivanti EPMM versions need remediation?

Ivanti EPMM versions before 12.10.0.1, 12.9.0.3, and 12.8.0.5 are affected. Upgrade to the applicable fixed version for the deployed release branch.

What is the expected impact of successful exploitation?

A successful attack can trigger a denial of service. The provided severity vector indicates no confidentiality or integrity impact.

CVE-2026-107405: Medium severity vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which Ivanti EPMM versions need remediation?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which Ivanti EPMM versions need remediation?

What is the expected impact of successful exploitation?