High severity8.8NVD Advisory· Published Sep 8, 2026· Updated Sep 9, 2026
CVE-2026-18851
CVE-2026-18851
Description
Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
Affected products
1- Range: <12.10.0.0, <12.9.0.2, <12.8.0.4
Patches
Vulnerability mechanics
References
1- hub.ivanti.com/s/article/Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851nvdPatchVendor Advisory
News mentions
3- ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksThe Hacker News · Sep 21, 2026
- Ivanti Patches Critical Flaws Across Enterprise Security ProductsSecurityWeek · Sep 9, 2026
- Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE AttacksCyber Security News · Sep 8, 2026