Medium severity4.9NVD Advisory· Published Nov 10, 2026

CVE-2026-107404

Description

Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.

Affected products

Ivanti/EPMMllm-fuzzy
Range: <12.10.0.1, <12.9.0.3, <12.8.0.5

Patches

Vulnerability mechanics

References

hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEsnvd

News mentions

Ivanti Patches New Security Flaws Affecting Endpoint Manager, EPMM, Sentry, CSA, and Workspace Manager
Cyber Security News · Nov 10, 2026

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000