CVE-2026-7821

State: Published
Severity: 7.4 High
Published: May 7, 2026
Updated: May 7, 2026
Reserved: May 4, 2026

Description

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	ivanti

Weaknesses

CWE-295 Improper certificate validation

Affected Products

Product	Versions
Endpoint Manager MobileIvanti	12.6.1.1Not affected 12.7.0.1Not affected 12.8.0.1Not affected

References

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.