CVE-2026-5787 is a high severity flaw (CVSS 8.9) in Ivanti Endpoint Manager Mobile (EPMM). Improper certificate validation lets a remote unauthenticated attacker impersonate registered Sentry hosts and obtain CA-signed client certificates. Upgrade to 12.6.1.1, 12.7.0.1 or 12.8.0.1, depending on your release line.
What's affected
- Ivanti EPMM before 12.6.1.1, before 12.7.0.1 and before 12.8.0.1.
- Fixed versions: 12.6.1.1, 12.7.0.1 and 12.8.0.1, per the record.
- Exposure matters most where Sentry hosts are registered with the EPMM server.
How to check if you're exposed
Check the EPMM version in the admin console and match it to your release line (12.6, 12.7 or 12.8). Then read the Ivanti May 2026 advisory, which covers this and related CVEs. Note whether your deployment uses Sentry.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade EPMM to the fixed version for your line.
- Read the Ivanti May 2026 advisory for any extra steps, such as certificate review.
- Review which client certificates your CA issued around the exposure window and revoke anything you cannot explain.
- Limit network access to the EPMM service where you can.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
This is CWE-295 (Improper Certificate Validation). A trust check that should prove who a Sentry host is does not do its job, so an outsider can pass as one and receive a certificate signed by your own CA. A certificate like that carries trust well beyond the moment it was issued.
The record does not flag this CVE as known exploited, and the CISA KEV flag is false.
Mobile device management servers sit in a sensitive spot. They hold device inventory and policy, and they decide what counts as a trusted device. A certificate issued to the wrong party can therefore matter long after the server is patched, which is why the certificate review step above is worth the effort.
Quick check
Is a patch alone enough?
The record only names fixed versions. Because certificates may already have been issued, the Ivanti advisory should be checked for any certificate cleanup guidance.
Sources
Last reviewed: 19 October 2026.
