CVE-2026-18851: Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate…

PriorityP260high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.02%

62.1th percentile

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ivanti	endpoint_manager_mobile	< 12.8.0.4	12.8.0.4
ivanti	endpoint_manager_mobile	—	—
ivanti	endpoint_manager_mobile	>= 12.9.0.0 < 12.9.0.2	12.9.0.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.