CVE-2026-7821 is a high severity (CVSS 7.4) improper certificate validation flaw in Ivanti Endpoint Manager Mobile (EPMM). A remote unauthenticated attacker could enroll a device from a restricted set of unenrolled devices. Update to 12.6.1.1, 12.7.0.1 or 12.8.0.1, depending on your line.
What's affected
- Product: Ivanti Endpoint Manager Mobile (EPMM).
- Affected: versions before 12.6.1.1, 12.7.0.1 and 12.8.0.1, in their respective lines.
- Fixed: 12.6.1.1, 12.7.0.1 and 12.8.0.1.
- Weakness: CWE-295, improper certificate validation.
- CVSS 7.4 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. Not listed in CISA KEV.
How to check if you're exposed
Open the EPMM admin portal and read the version from the about page, then compare it with the fixed builds for your line. Ivanti's advisory page did not load for me, so use the May 2026 EPMM advisory on the Ivanti hub for the full list of CVEs in that release.
Also review the device list for enrollments you do not recognize, particularly in the period before you patch. The record says the impact is information disclosure about the EPMM appliance and an effect on the integrity of the new device identity.
What to do now
- Check your EPMM version and the fixed build for your line.
- Update to 12.6.1.1, 12.7.0.1 or 12.8.0.1, or later, following Ivanti's guidance.
- Audit the enrolled device list for unexpected or duplicate entries, and remove ones you cannot account for.
- Read the May 2026 Ivanti advisory for the other EPMM CVEs fixed in the same release.
- Restrict who can reach the enrollment endpoints, where your device fleet allows it.
Why it matters
Certificate validation is how a server decides who it is talking to. The record says EPMM did not do it properly, which let an unauthenticated remote party enroll a device out of a restricted set of unenrolled ones. That is a trust decision made on weak evidence.
Mobile device managers sit in a sensitive spot, since they issue identity to phones and laptops. Keep them patched and watch the enrollment list.
Quick check
What is the impact?
The record states information disclosure about the EPMM appliance and an effect on the integrity of the newly enrolled device identity.
Sources
Last reviewed: 19 October 2026.
