CVE-2026-7821

Summary

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.

Affected Software

VendorProductVersion RangeStatus
IvantiEndpoint Manager Mobile12.6.1.1unaffected
IvantiEndpoint Manager Mobile12.7.0.1unaffected
IvantiEndpoint Manager Mobile12.8.0.1unaffected

Weaknesses

  • CWE-295: CWE-295 Improper certificate validation

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References