Vulnerability intelligence

CVE-2026-18851

Ivanti Endpoint Manager Mobile CWE-862

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

CVSS Score

8.8

High

EPSS — Exploit Probability

1.0%

Riskier than 63% of all CVEs · checked 2026-10-22

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Unconfirmed

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Sep 8, 2026 · latest Sep 8, 2026

Coverage timeline

Ivanti Patches Flaws That Could Grant Attackers Admin Access
securityonline.info · Sep 8, 2026

Related CVEs — Ivanti

CVE-2026-104935KEV CVE-2026-106042 CVE-2026-109412 CVE-2026-106034 CVE-2026-106035 CVE-2019-11510KEV CVE-2023-46805KEV CVE-2024-21887KEV