CVE-2026-5787
Improper Certificate Validation in Ivanti EPMM
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: ivanti
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ivanti | epmm | to 12.8.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Certificate Validation issue in Ivanti EPMM versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. It allows a remote unauthenticated attacker to impersonate registered Sentry hosts by obtaining valid CA-signed client certificates.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can impersonate trusted hosts within the Ivanti EPMM environment, potentially gaining unauthorized access to sensitive systems or data. This can lead to a complete compromise of confidentiality and integrity, and partial impact on availability.