CVE-2026-5788
📛 CVE Title
CVE-2026-5788
Description
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- ivanti
- CVSS severity
- HIGH
- CVSS score
- 7.0 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L- Effective score
- 7.0 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-284 - Reserved
- 2026-04-08
- Published
- 2026-05-07 17:29 UTC
- Last updated
- 2026-05-07 18:16 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5788.json
- Linked Threat
- CVE-2026-5788 — CVE-2026-5788
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-07 16:16:22 UTC
- NVD last modified
- 2026-05-07 20:11:27 UTC
- NVD CVSS v3.1
- 7.0 / 10 HIGH source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
- NVD CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L- Exploitability subscore
- 2.2 / 10
- Impact subscore
- 4.7 / 10
- EPSS score
- 0.0025 (probability of exploitation in next 30 days)
- EPSS percentile
- 48.48% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD / KEV / EPSS data refreshed 2026-05-25 07:28 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-28395 - Assigner
- ivanti
- Published
- May 7, 2026, 3:29:49 PM
- Updated
- May 7, 2026, 4:16:36 PM
- EUVD base score (CVSS 3.1)
-
7.0 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L - EUVD-reported EPSS
- 0.2500
- Vendors
- Ivanti
- Products
-
Endpoint Manager Mobile (patch: 12.8.0.1)Endpoint Manager Mobile (patch: 12.6.1.1)Endpoint Manager Mobile (patch: 12.7.0.1)
ENISA description: An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Ivanti | Endpoint Manager Mobile |
12.8.0.1 (unaffected),
12.7.0.1 (unaffected),
12.6.1.1 (unaffected)
|
— |
Affected products — CPE 2.3 (3) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:*
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:app.opencve.io
Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Check the Ivanti Endpoint Manager Mobile version and upgrade to a release newer than 12.6.1.1, 12.7.0.1, or 12.8.0.1 as soon as a patch is available. Apply the vendor-provided update or patch to eliminate the access control flaw.
2026-05-22 17:31 UTC -
web:blog.toolslib.net
Ivanti EPMM patches five CVEs ( CVE - 2026 -5786/5787/ 5788 /6973/7821). See what's confirmed, what's unknown, and the fixed versions to deploy now.
2026-05-22 17:31 UTC -
web:cisa.gov
Update (08/12/2025): CISA has updated this alert to provide clarification on identifying Exchange Servers on an organization's networks and provided further guidance on running the Microsoft Exchange Health Checker. Update (08/07/2025): CISA issued Emergency Directive (ED) 25-02: Mitigate Microsoft Exchange Vulnerability in response to CVE -2025-53786
2026-05-22 17:31 UTC -
web:krebsonsecurity.com
The reason is that after the Patch Tuesday on October 14, 2025, Microsoft will stop shipping free security updates for Windows 10 computers.
2026-05-22 17:31 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 17:31 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 107 vulnerabilities, including one publicly disclosed zero-day and 13 critical, in its August 2025 Patch Tuesday rollout.
2026-05-22 17:31 UTC -
web:www.forbes.com
Microsoft has confirmed that SharePoint Server is under mass global attack. Breaking: An emergency patch has now been released — update immediately.
2026-05-22 17:31 UTC -
web:www.securityweek.com
Microsoft's August 2025 Patch Tuesday updates address critical vulnerabilities in Windows, Office, and Hyper-V.
2026-05-22 17:31 UTC -
web:www.tenable.com
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
2026-05-22 17:31 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-22 17:31 UTC
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (8)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://www.securityweek.com/ivanti-patches-epmm-zero-day-exploited-in-targeted-attacks/ tenable:www.securityweek.com
- https://cyberscoop.com/ivanti-epmm-zero-day-vulnerability-exploited/ tenable:cyberscoop.com
- https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US tenable:hub.ivanti.com
- https://nvd.nist.gov/vuln/detail/CVE-2026-5788 tenable:nvd.nist.gov
- https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html tenable:thehackernews.com
- https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-epmm-flaw-exploited-in-zero-day-attacks/ tenable:www.bleepingcomputer.com
- https://www.cve.org/CVERecord?id=CVE-2026-5788 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 Vendor AdvisoryPatch
Indicators (3)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| ipv4 |
12.6.1.1
|
no local data | 2026-05-18 21:18 UTC |
| ipv4 |
12.7.0.1
|
no local data | 2026-05-18 21:18 UTC |
| ipv4 |
12.8.0.1
|
no local data | 2026-05-18 21:18 UTC |
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-5788.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5788",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-07T16:16:29.858121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T16:16:36.899Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Endpoint Manager Mobile",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "12.8.0.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "12.7.0.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "12.6.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods."
}
],
"value": "An Improper Access Control in Ivanti EPMM before\u00a0versions 12.6.1.1, 12.7.0.1, and 12.8.0.1\u00a0allows a remote unauthenticated attacker to invoke arbitrary methods."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-07T15:29:49.630Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-5788",
"datePublished": "2026-05-07T15:29:49.630Z",
"dateReserved": "2026-04-08T11:39:14.350Z",
"dateUpdated": "2026-05-07T16:16:36.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}