CVE-2026-5788: Access Control Flaw in Ivanti EPMM

CVE-2026-5788 is a high severity flaw (CVSS 7.0) in Ivanti Endpoint Manager Mobile (EPMM). Improper access control allows a remote unauthenticated attacker to invoke arbitrary methods. Upgrade to 12.6.1.1, 12.7.0.1 or 12.8.0.1, depending on your release line, and read the Ivanti advisory.

What's affected

• Ivanti EPMM before 12.6.1.1, before 12.7.0.1 and before 12.8.0.1.
• Fixed versions: 12.6.1.1, 12.7.0.1 and 12.8.0.1.

How to check if you're exposed

Look up the EPMM version in the admin console and compare it to the fixed version for your line. The Ivanti May 2026 advisory covers this CVE together with CVE-2026-5787.

Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.

What to do now

1. Upgrade EPMM to the fixed release for your line.
2. Restrict access to the EPMM server to the networks that need it.
3. Review server logs for unusual requests from unknown sources.

After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.

Why it matters

This is CWE-284 (Improper Access Control). Some internal methods can be reached without the permission checks that should guard them. The record scores attack complexity as high, which lowers the rating, but no login is needed.

The CISA KEV flag is false for this record.

Read this together with CVE-2026-5787, since both land in the same Ivanti advisory and the same fixed versions. Treat the upgrade as one change that closes both.

Quick check

Sources

• Ivanti security advisory

Last reviewed: 19 October 2026.