High severity8.8NVD Advisory· Published Sep 8, 2026· Updated Sep 8, 2026

CVE-2026-18851

Description

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

Affected products

Ivanti/Endpoint Manager Mobilellm-fuzzy
Range: <12.10.0.0, <12.9.0.2, <12.8.0.4

Patches

Vulnerability mechanics

References

hub.ivanti.com/s/article/Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851nvd

News mentions

Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE Attacks
Cyber Security News · Sep 8, 2026

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000