CVE-2026-10727: An OS command injection vulnerability in Ivanti EPMM before 12

Synopsis

An OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) allows a remote, authenticated attacker with administrative privileges to inject and execute arbitrary operating system commands as the root user. The attack is carried out over the network and requires no victim interaction. Successful exploitation gives the attacker full control of the underlying host, including reading, modifying, or destroying all data and services on the system. A patched-image rebuild at versions 12.7.0.2, 12.8.0.3, or 12.9.0.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the EPMM service over the network; the attack vector is network-exposed (AV:N).

• AuthenticationRequired

  A high-privilege (administrative) account is required; no path exists for unauthenticated exploitation (PR:H).

• Victim interactionNot required

  No user action or social engineering is needed; the attacker triggers exploitation entirely on their own (UI:N).

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental factors required (AC:L).

Blast Radius

• Reads all data accessible to the root user, including credentials, certificates, device enrollment records, and MDM policy configurations stored on the host.
• Modifies or deletes any file on the system, including EPMM configuration, enrolled-device data, and OS binaries.
• Installs persistent backdoors or malware running as root, giving the attacker lasting control even after credential rotation.
• Crashes or disables the EPMM service entirely, blocking mobile device management operations for all enrolled devices.