Brief Summary: CVE-2026-5786 Improper Access Control in Ivanti EPMM Enables Authenticated Privilege Escalation to Admin

Introduction

Any authenticated user on an Ivanti Endpoint Manager Mobile appliance can silently escalate their privileges to full administrative control, thanks to an improper access control flaw disclosed on May 7, 2026. For organizations that use EPMM to manage their mobile device fleet, this vulnerability (scored CVSS 8.8) means a single compromised standard user account could give an attacker the keys to the entire MDM infrastructure, including device policies, configurations, and integrations.

Ivanti Endpoint Manager Mobile is an on-premises mobile device management platform. Enterprises and government agencies use it to enforce security policies and manage mobile endpoints at scale. It controls which devices can access corporate resources and how those devices are configured.

Technical Information

CVE-2026-5786 is classified under CWE-284 (Improper Access Control). The CVSS 3.1 vector reported by the Centre for Cybersecurity Belgium is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is exploitable over the network, has low attack complexity, needs only low privileges (any authenticated user), needs no user interaction, and has high impact on confidentiality, integrity, and availability.

Root Cause

The EPMM appliance fails to enforce access control correctly. Authenticated sessions with low privilege levels could reach administrative functionality that should have been restricted to admin roles. EPMM is a closed-source commercial product, so no source-level code diffs or commit details are public. The patch description does confirm that the fix tightens access control enforcement so low-privilege authenticated sessions can no longer reach administrative functionality.

Attack Flow

Based on the available information, exploitation proceeds in four steps:

1. The attacker obtains, or already has, valid credentials for any user account on the target EPMM appliance. This could be a standard, non-administrative account.
2. The attacker authenticates to the EPMM instance remotely over the network.
3. Because access control is not enforced correctly, the attacker reaches administrative functionality that their privilege level should not permit.
4. The attacker gains full administrative access to the EPMM appliance, which controls policies, configurations, and integrations for the entire managed mobile device fleet.

Scope Boundaries

This vulnerability is strictly limited to the on-premises Endpoint Manager Mobile product. Ivanti confirmed that it does not affect Ivanti Neurons for MDM (their cloud-based unified endpoint management solution), Ivanti EPM, Ivanti Sentry, or any other Ivanti products.

Related May 2026 Vulnerabilities

The May 2026 advisory fixed four other high-severity vulnerabilities alongside CVE-2026-5786:

Two of these chain together. CVE-2026-5786 takes any authenticated user to admin, and CVE-2026-6973 gives code execution from an admin context. Combined, they would let any authenticated user achieve remote code execution on the appliance.

Patch Information

On May 7, 2026, Ivanti published a security advisory addressing CVE-2026-5786 and four other high-severity vulnerabilities. The fix ships as full version updates, not through the temporary RPM script mechanism Ivanti used for the January 2026 EPMM vulnerabilities (CVE-2026-1281 and CVE-2026-1340). Unlike those scripts, the new releases are permanent fixes integrated into the product.

The patch tightens access control enforcement so that low-privilege authenticated sessions can no longer reach administrative functionality.

Ivanti released three fixed versions, one for each supported major release branch:

For each fixed version, Ivanti provides a fresh-install ISO and an in-place appliance update package through its download portal (login required). Version 12.8.0.1, for example, is available as mobileiron-12.8.0.1-217.iso for new instances and as an update directory for existing appliances.

Upgrading to any of these versions also installs the permanent fixes for the critical January 2026 zero-days (CVE-2026-1281 and CVE-2026-1340), so the temporary RPM packages distributed in January are no longer needed after the update.

Because EPMM is closed source, no source-level code diffs or commit details are public. The patch is applied entirely through Ivanti's proprietary update mechanism.

Affected Systems and Versions

The vulnerability affects these Ivanti Endpoint Manager Mobile versions:

• EPMM versions prior to 12.8.0.1 on the 12.8.x branch
• EPMM versions prior to 12.7.0.1 on the 12.7.x branch
• EPMM versions prior to 12.6.1.1 on the 12.6.x branch

Only the on-premises deployment of Endpoint Manager Mobile is affected. Ivanti explicitly lists these products as unaffected:

• Ivanti Neurons for MDM (cloud-based)
• Ivanti EPM (Endpoint Manager, the non-mobile product)
• Ivanti Sentry
• All other Ivanti products

Vendor Security History

Advanced threat actors have repeatedly targeted Ivanti infrastructure:

Ivanti has high confidence that the administrative credentials used to exploit CVE-2026-6973 were harvested during the January 2026 zero-day campaign. Patching alone is not enough when credentials may have been compromised. Rotate them as part of the same response.

References

• NVD Entry for CVE-2026-5786
• May 2026 Security Advisory: Ivanti Endpoint Manager Mobile (EPMM) Multiple CVEs
• Ivanti Forums: May 2026 Security Advisory
• BleepingComputer: Ivanti warns of new EPMM flaw exploited in zero day attacks
• Centre for Cybersecurity Belgium Advisory
• Ivanti Blog: May 2026 EPMM Security Update
• CWE-284: Improper Access Control
• Kudelski Security: CVE-2026-1281 and CVE-2026-1340 Affecting Ivanti EPMM
• Unit 42: Critical Vulnerabilities in Ivanti EPMM Exploited
• Wikipedia: Ivanti Pulse Connect Secure data breach