CVE-2026-18851: High severity Ivanti Ivanti Endpoint Manager Mobile vulnerability
Published Sep 8, 2026
·Updated
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
Affected Software
4 affected components
Ivanti Ivanti Endpoint Manager Mobile><=12.10.0.0, ><=12.9.0.2, ><=12.8.0.4
Ivanti Endpoint Manager Mobile<12.8.0.4
Ivanti Endpoint Manager Mobile>=12.9.0.0<12.9.0.2
Ivanti Endpoint Manager Mobile=12.10.0.0
Remediation
Event History
Sep 8, 2026
CVE Published
via MITRE·02:14 PM
Data Sourced
via MITRE·02:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker who is already authenticated to Ivanti Endpoint Manager Mobile can exploit the missing authorization check. No user interaction is required.
2
Which versions need to be remediated?
Versions before 12.10.0.0, 12.9.0.2, and 12.8.0.4 are affected. Upgrade to the applicable listed version or later.
3
What is the impact if exploitation succeeds?
An authenticated attacker can escalate their privileges to administrator. The vulnerability is rated high with impacts to confidentiality, integrity, and availability.