Introduction
An improper certificate validation flaw in Ivanti Endpoint Manager Mobile (EPMM) lets a remote, unauthenticated attacker impersonate registered Sentry hosts and walk away with valid CA-signed client certificates. The timing makes this disclosure particularly urgent. It arrived in the same May 2026 advisory as CVE-2026-6973, a separate EPMM vulnerability that is already under active zero-day exploitation.
Ivanti EPMM (formerly MobileIron Core) is an enterprise mobile device management platform that organizations worldwide use to manage, secure, and enforce policy on mobile endpoints. In enterprise mobility architectures it often sits where identity, certificate, and access management systems meet. Sentry is the gateway that brokers access between managed devices and backend resources.
Technical Information
CVE-2026-5787 is rooted in CWE-295: Improper Certificate Validation. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L, which yields a score of 8.9.
The attack vector is the network (AV:N), so any attacker who can reach the EPMM instance over the network can attempt exploitation. Attack complexity is rated high (AC:H), which suggests that specific conditions beyond the attacker's control must be met, but the attack requires no privileges (PR:N) and no user interaction (UI:N). The scope change (S:C) is the most consequential part of the vector. It tells us that a successful exploit crosses a trust boundary and compromises resources beyond the EPMM server itself.
Root Cause
The vulnerability lies in how the on-premises EPMM server validates the identity of Sentry hosts during certificate operations. EPMM maintains a trust relationship with registered Sentry appliances, and part of that relationship is issuing CA-signed client certificates to legitimate Sentry hosts. Because validation is improper, EPMM does not adequately verify that a host requesting a certificate is a legitimately registered Sentry instance.
Attack Flow
Based on the available information, exploitation generally follows this sequence:
- The attacker identifies a network-reachable, on-premises EPMM instance.
- The attacker crafts requests that impersonate a registered Sentry host and take advantage of the insufficient certificate validation logic.
- EPMM fails to properly validate the requesting host's identity and issues a valid CA-signed client certificate to the attacker.
- The attacker now holds a trusted certificate that can authenticate to other components in the MDM infrastructure. With it, the attacker may be able to access restricted information or pivot deeper into the environment.
This chain is why the CVSS vector shows a scope change. The initial vulnerability is in EPMM, but the impact extends to any system that trusts the CA-signed certificates EPMM issues. In environments where Sentry mediates access to email, internal applications, or other backend services, a forged Sentry certificate could grant broad unauthorized access.
Sentry Is Not Directly Vulnerable
The flaw is entirely within the EPMM server's validation logic, and Sentry itself does not contain it. EPMM and Sentry do depend on each other operationally, though, so their versions have to line up when you apply updates. Organizations adding new Sentry servers after patching EPMM must use Sentry versions 10.4.2, 10.5.1, or 10.6.1 to maintain compatibility.
Cloud Deployments Are Unaffected
Ivanti has confirmed that the cloud-based Ivanti Neurons for MDM product is not affected by CVE-2026-5787. Only on-premises EPMM deployments are vulnerable, which is one example of how on-premises architectures and cloud-managed services carry different risks.
Affected Systems and Versions
The following on-premises EPMM versions are vulnerable:
| Product Component | Vulnerable Versions | Fixed Versions |
|---|---|---|
| Ivanti EPMM 12.6.x | Before 12.6.1.1 | 12.6.1.1 |
| Ivanti EPMM 12.7.x | Before 12.7.0.1 | 12.7.0.1 |
| Ivanti EPMM 12.8.x | Before 12.8.0.1 | 12.8.0.1 |
Organizations that add new Sentry servers after the EPMM update need one of these Sentry versions for compatibility:
| Sentry Version | Notes |
|---|---|
| 10.4.2 | Required only when adding new Sentry servers after the update |
| 10.5.1 | Required only when adding new Sentry servers after the update |
| 10.6.1 | Required only when adding new Sentry servers after the update |
Ivanti Neurons for MDM (cloud) is explicitly out of scope.
The fixed EPMM versions also include cumulative fixes for CVE-2026-1281 and CVE-2026-1340, so organizations that previously applied the January 2026 RPM package no longer need that separate remediation.
Vendor Security History
CVE-2026-5787 was disclosed alongside four other vulnerabilities in the same May 2026 advisory. Together they suggest a product under significant security scrutiny:
| CVE Identifier | CVSS Score | Exploitation Status | Description |
|---|---|---|---|
| CVE-2026-6973 | Not provided | Actively exploited (zero day) | Requires admin authentication |
| CVE-2026-5786 | 8.8 | No known exploitation | Remote Code Execution, low privileges required |
| CVE-2026-5787 | 8.9 | No known exploitation | Improper Certificate Validation, no privileges required |
| CVE-2026-5788 | Not provided | No known exploitation | Allows attackers to invoke arbitrary methods |
| CVE-2026-7821 | Not provided | No known exploitation | Unauthenticated, requires Apple Device Enrollment configuration |
Ivanti has also disclosed and patched earlier EPMM vulnerabilities in recent months, including CVE-2026-1281 and CVE-2026-1340, which a January 2026 advisory addressed. Ivanti said its recent integration of advanced AI models into its product security processes helped find vulnerabilities that traditional tooling had missed, including some in this May 2026 advisory.
References
- NVD Entry for CVE-2026-5787
- CVE Record for CVE-2026-5787
- May 2026 Security Advisory: Ivanti Endpoint Manager Mobile (EPMM) Multiple CVEs
- Belgium CCB Advisory: Authenticated Remote Code Execution Vulnerability in Ivanti EPMM
- BleepingComputer: Ivanti warns of new EPMM flaw exploited in zero day attacks
- CybersecurityNews: New Ivanti EPMM 0 Day Vulnerability Actively Exploited
- Ivanti Forums: May 2026 Security Advisory
