IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek

CVE-2026-18851

Ivanti Endpoint Manager Mobile Yayım: (1 ay önce)

Açıklama

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

Zayıflık türü (CWE): CWE-862

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Ivanti Endpoint Manager Mobile fixed 12.10.0.0, fixed 12.9.0.2, fixed 12.8.0.4

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (3)
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* < 12.8.0.4
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* ≥ 12.9.0.0 < 12.9.0.2
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:12.10.0.0:*:*:*:*:*:*:*

Aynı üründe son açıklar — Ivanti (Connect Secure, EPMM…)

9.9Kritik
CVE-2026-109412
Ivanti Neurons Patch for Intune

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

7.7Yüksek
CVE-2026-106047
Ivanti Xtraction

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

7.5Yüksek
CVE-2026-106043
Ivanti Xtraction

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

9.9Kritik
CVE-2026-106042
Ivanti Xtraction

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmi…

5.5Orta
CVE-2026-106035
Ivanti Xtraction

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.