[NEU] [hoch] Ivanti Endpoint Manager Mobile: Schwachstelle ermöglicht Erlangen von Administratorrechten

highCVE-2026-18851

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Ivanti Endpoint Manager Mobile ausnutzen, um Administratorrechte zu erlangen.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-09-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3270

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-188511.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-18851	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownNCSC-2026-0359 [1.00] [M/H] Kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobilencsc-nl
unknownMultiples vulnérabilités dans les produits Ivanti (09 septembre 2026)cert-fr-avis
unknownIvanti security advisory (AV26-897)cccs
highCVE-2026-18851: Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, an…nvd

Recent advisories for Ivanti Endpoint Manager Mobile

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownNCSC-2026-0359 [1.00] [M/H] Kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobilencsc-nl · 2026-09-09
highCVE-2026-18851: Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, an…nvd · 2026-09-08
criticalexploitedCVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerabilitycisa-kev · 2026-05-07
criticalexploitedCVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerabilitycisa-kev · 2026-04-08
unknownexploited[MàJ] Multiples vulnérabilités dans Ivanti Endpoint Manager Mobile (30 janvier 2026)cert-fr-alerte · 2026-01-30
criticalexploitedCVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerabilitycisa-kev · 2026-01-29