Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN496
_____________________________________________________________________

DATE                : 13/05/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Ivanti Endpoint Manager (EPM)
                      versions prior to 2024 SU6.

=====================================================================
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US
_____________________________________________________________________

Security Advisory Ivanti Endpoint Manager (EPM) May 2026

Primary Product
Endpoint Manager

Created Date
May 12, 2026 1:59:54 PM

Last Modified Date
May 12, 2026 2:07:56 PM

Security Advisory Ivanti Endpoint Manager (EPM) (CVE-2026-8109,
CVE-2026-8110, CVE-2026-811)

Summary

Ivanti has released updates for Ivanti Endpoint Manager which
addresses one Medium severity and two High severity vulnerabilities.
Successful exploitation could lead to information disclosure,
privilege escalation, or remote code execution.

We are not aware of any customers being exploited by these
vulnerabilities at the time of disclosure.

 

Vulnerability Details

CVE Number  Description  CVSS Score (Severity)  CVSS Vector  CWE 

CVE-2026-8109 
An exposed dangerous method on the Core Server of Ivanti Endpoint
Manager before version 2024 SU6 allows a remote authenticated
attacker to leak access credentials. 
6.5 (Medium) 
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 
CWE-749 

CVE-2026-8110 
Incorrect permissions assignment in the agent of Ivanti Endpoint
Manager before version 2024 SU6 allows a local authenticated
attacker to escalate their privileges. 
7.8 (High) 
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 
CWE-732 

CVE-2026-8111 
SQL injection in the web console of Ivanti Endpoint Manager before
version 2024 SU6 allows a remote authenticated attacker to achieve
remote code execution. 
8.8 (High) 
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 
CWE-89 

 

Affected Versions

Product Name     Affected Version(s)  Resolved Version(s) 
Patch Availability 

Ivanti Endpoint Manager (EPM)  2024 SU5 and prior   2024 SU6 
Download Available in ILS 
 

Solution

Customers can resolve these vulnerabilities by updating to Ivanti
EPM 2024 SU6, available in ILS. 


Acknowledgements

Ivanti would like to thank the following for reporting the relevant
issues and for working with Ivanti to help protect our customers:

06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Zero Day
Initiative (CVE-2026-8109)

Note: Ivanti is dedicated to ensuring the security and integrity of
our enterprise software products. We recognize the vital role that
security researchers, ethical hackers, and the broader security
community play in identifying and reporting vulnerabilities. Visit
HERE to learn more about our Vulnerability Disclosure Policy.

FAQ

Are you aware of any active exploitation of these vulnerabilities?

We are not aware of any customers being exploited by these
vulnerabilities prior to public disclosure. These vulnerabilities
were disclosed through our responsible disclosure program.  

How can I tell if I have been compromised? 
Currently, there is no known public exploitation of these
vulnerabilities that could be used to provide a list of
indicators of compromise.

What should I do if I need help? 

If you have questions after reviewing this information, you
can log a case and/or request a call via the Success Portal .

Are these vulnerabilities in Ivanti EPMM?

No. Ivanti Endpoint Manager Mobile (EPMM) has a similar name
to Ivanti Endpoint Manager (EPM), but these are separate
products.


Article Number : 000106655
Article Promotion Level
Normal

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================