Argument Injection Vulnerability in Ivanti EPMM Product
CVE-2026-107404

4.9MEDIUM

Key Information:

Vendor

Ivanti
Status
Endpoint Manager Mobile
Vendor
CVE Published:
10 November 2026

What is CVE-2026-107404?

An argument injection vulnerability in Ivanti EPMM prior to versions 12.10.0.1, 12.9.0.3, and 12.8.0.5 enables a remote authenticated attacker with administrative privileges to execute actions that can lead to the deletion of arbitrary files from the system's disk. This poses significant risks, allowing unauthorized file management and potential data loss.

Affected Version(s)

Endpoint Manager Mobile 12.11.0.0

Endpoint Manager Mobile 12.11.0.0

Endpoint Manager Mobile 12.10.0.1

References

https://hub.ivanti.com/s/article/November-2026-Security-A...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.