CVE-2026-5786

Description

An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.

Overview

State: PUBLISHED
Assigner (CNA): ivanti
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-284
Reserved: 2026-04-08
Published: 2026-05-07 17:18 UTC
Last updated: 2026-05-08 05:55 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5786.json
Linked Threat: CVE-2026-5786 — CVE-2026-5786

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-07 16:16:22 UTC
NVD last modified: 2026-05-07 20:12:47 UTC
NVD CVSS v3.1: 8.8 / 10 HIGH source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0040 (probability of exploitation in next 30 days)
EPSS percentile: 60.49% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-28393
Assigner: ivanti
Published: May 7, 2026, 3:18:54 PM
Updated: May 8, 2026, 3:55:39 AM
EUVD base score (CVSS 3.1): 8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.4000
Vendors: Ivanti
Products: Endpoint Manager Mobile (patch: 12.8.0.1)

Endpoint Manager Mobile (patch: 12.6.1.1)

Endpoint Manager Mobile (patch: 12.7.0.1)

ENISA description: An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.

EUVD references (1)

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs

Affected products (1)

Vendor	Product	Versions	Platforms
Ivanti	Endpoint Manager Mobile	`12.8.0.1` (unaffected), `12.7.0.1` (unaffected), `12.6.1.1` (unaffected)	—

Affected products — CPE 2.3 (3) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:*

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://www.securityweek.com/ivanti-patches-epmm-zero-day-exploited-in-targeted-attacks/ tenable:www.securityweek.com
https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US tenable:hub.ivanti.com
https://nvd.nist.gov/vuln/detail/CVE-2026-5786 tenable:nvd.nist.gov
https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html tenable:thehackernews.com
https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-epmm-flaw-exploited-in-zero-day-attacks/ tenable:www.bleepingcomputer.com
https://www.cve.org/CVERecord?id=CVE-2026-5786 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 Vendor AdvisoryPatch

Indicators (3)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
ipv4	`12.6.1.1`	no local data	2026-05-18 21:18 UTC
ipv4	`12.7.0.1`	no local data	2026-05-18 21:18 UTC
ipv4	`12.8.0.1`	no local data	2026-05-18 21:18 UTC

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Ivanti EPMM updates address multiple flaws (CVE-2026-5786/5787/5788 ...

web:blog.toolslib.net

Ivanti EPMM patches five CVEs ( CVE - 2026 - 5786 /5787/5788/6973/7821). See what's confirmed, what's unknown, and the fixed versions to deploy now.

2026-05-22 17:31 UTC
CERT-EU - High Severity Vulnerability in Microsoft Exchange

web:cert.europa.eu

CERT-EU - High Severity Vulnerability in Microsoft Exchange Summary On August 6, 2025, Microsoft issued an advisory for a high-severity vulnerability affecting Microsoft Exchange hybrid environments [1]. The vulnerability tracked as CVE -2025-53786 allows an attacker with administrative access to an on-premises Exchange Server to escalate privileges into the connected Exchange Online ...

2026-05-22 17:31 UTC
Microsoft Releases Guidance on High-Severity Vulnerability (CVE-2025 ...

web:cisa.gov

Update (08/12/2025): CISA has updated this alert to provide clarification on identifying Exchange Servers on an organization's networks and provided further guidance on running the Microsoft Exchange Health Checker. Update (08/07/2025): CISA issued Emergency Directive (ED) 25-02: Mitigate Microsoft Exchange Vulnerability in response to CVE -2025-53786

2026-05-22 17:31 UTC
CVE-2025-53786 - Exploits & Severity - Feedly

web:feedly.com

Mitigation Immediately prioritize patching all affected Exchange Server versions to the latest cumulative updates. Apply the April 2025 or later Hot Fix . Implement the security configuration changes outlined in Microsoft's April 18th, 2025 announcement for hybrid deployments.

2026-05-22 17:31 UTC
CISA Issues Urgent Advisory Calling on Federal Agencies to Fix Exchange ...

web:infosectoday.com

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency advisory mandating all Federal Civilian Executive Branch agencies to urgently address a newly identified vulnerability in Microsoft Exchange, tracked as CVE -2025-53786, by 9:00 AM EDT on Monday, August 11, 2025. This vulnerability allows attackers with administrative access to an on-premises Exchange server to ...

2026-05-22 17:31 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 17:31 UTC
CVE-2025-53786 Microsoft Exchange Server Hybrid Deployment Elevation of ...

web:thewindowsupdate.com

Microsoft strongly recommends reading the information, installing the April 2025 ( or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

2026-05-22 17:31 UTC
CVE Record: CVE-2025-53786

web:www.cve.org

Microsoft is issuing CVE -2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 ( or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

2026-05-22 17:31 UTC
CISA, Microsoft warn about new Microsoft Exchange server vulnerability

web:www.cybersecuritydive.com

The Cybersecurity and Infrastructure Security Agency (CISA) and Microsoft late Wednesday warned that a new high-severity vulnerability in Microsoft Exchange could let hackers pivot from the on-premises version of the product to the cloud version and potentially gain total control of the system. The vulnerability, tracked as CVE -2025-53786, could allow an attacker with administration privileges ...

2026-05-22 17:31 UTC
Microsoft urges admins to plug severe Exchange security hole (CVE-2025 ...

web:www.helpnetsecurity.com

In a Microsoft Exchange hybrid deployment, CVE -2025-53786 could be exploited by attackers to access the org's connected cloud environment.

2026-05-22 17:31 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-5786.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-07T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T03:55:39.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Endpoint Manager Mobile",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "12.8.0.1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "12.7.0.1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "12.6.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.&nbsp;"
            }
          ],
          "value": "An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T15:18:54.437Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2026-5786",
    "datePublished": "2026-05-07T15:18:54.437Z",
    "dateReserved": "2026-04-08T11:39:11.525Z",
    "dateUpdated": "2026-05-08T03:55:39.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}