Privilege Escalation in Ivanti Endpoint Manager Mobile

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: ivanti

Description

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-18851

Affected Vendors & Products

Vendor	Product	Version / Range
ivanti	endpoint_manager_mobile	to 12.8.0.4 (exc)
ivanti	endpoint_manager_mobile	From 12.9.0.0 (inc) to 12.9.0.2 (exc)
ivanti	endpoint_manager_mobile	12.10.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization issue in Ivanti Endpoint Manager Mobile versions before 12.10.0.0, 12.9.0.2, and 12.8.0.4. A remote authenticated attacker can exploit this to escalate their privileges to admin level.

Impact Analysis

An attacker could gain administrative access to the Ivanti Endpoint Manager Mobile system, potentially allowing them to perform unauthorized actions, access sensitive data, or disrupt services.

Mitigation Strategies

Update Ivanti Endpoint Manager Mobile to version 12.10.0.0, 12.9.0.2, or 12.8.0.4 or later to address the missing authorization issue.

Hi! I’m here to help you understand CVE-2026-18851. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70