VORANT. Threat Intelligence Sign in Get the full feed

Ivanti EPM privilege-escalation flaw patched

routine vulnerability technology

Ivanti fixed a missing authorization check in Endpoint Manager Mobile that lets authenticated users escalate to admin privileges.

NCSC-NL published an advisory covering CVE-2026-18851, a missing authorization vulnerability in Ivanti Endpoint Manager Mobile (EPMM). The flaw affects versions prior to 12.10.0.0, 12.9.0.2, and 12.8.0.4, and allows an authenticated user to escalate privileges to an administrative level, likely by bypassing an authorization check on a sensitive function or endpoint. Ivanti has released updated versions that address the issue.

The vulnerability carries a CVSS v3 score of 8.8, reflecting the significant impact of full administrative compromise despite requiring prior authentication. No indication of active exploitation is mentioned in the advisory. Defenders running Ivanti EPMM should prioritize patching to the fixed versions (12.10.0.0, 12.9.0.2, or 12.8.0.4 or later) and review authentication logs and administrative account activity for signs of unauthorized privilege changes, particularly from lower-privileged accounts.

Mentioned in this report

Vulnerabilities CVE-2026-18851

Related reporting

Detection guidance

Ivanti EPMM Unauthenticated Administrative API Access

ATT&CK T1068

Detects HTTP requests to Ivanti EPMM administrative endpoints from non-admin accounts or sessions, exploiting CVE-2026-18851 authorization bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Ivanti EPMM Unauthenticated Administrative API Access
description: Detects HTTP POST/GET requests to Ivanti EPMM admin API endpoints (typically
  /api/v2/admin/*, /api/*/mdm/admin) from sessions lacking administrative privileges
  or from unexpected sources, indicative of authorization bypass exploitation.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: proxy
  product: ivanti
detection:
  selection:
    DestinationHostname|contains:
    - epmm
    - endpoint.ivanti
    URI|contains:
    - /api/v2/admin/
    - /api/mdm/admin/
    - /admin/
    HTTPMethod:
    - POST
    - GET
  filter_admin_session:
    UserPrivilegeLevel: admin
  filter_internal_admin:
    SourceIPAddress|cidr: 10.0.0.0/8
  condition: selection and not filter_admin_session and not filter_internal_admin
falsepositives:
- Legitimate admin access from unexpected network segments (VPN, mobile)
- API calls from third-party integrations with insufficient session context logging
level: high
id: f7b0396c-3603-579e-81b6-2e0633e14405
status: experimental
author: Vorant

Suspicious Administrative Role Assignment in Ivanti EPMM

ATT&CK T1068

Detects process or API activity within Ivanti EPMM that grants administrative privileges to a previously non-admin user account, exploiting authorization checks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Administrative Role Assignment in Ivanti EPMM
description: Detects API calls or database modifications within Ivanti EPMM that elevate
  a user account from standard to administrative role, bypassing normal authorization
  workflow. Monitors for privilege escalation post-authentication.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: proxy
  product: ivanti
detection:
  selection:
    DestinationHostname|contains:
    - epmm
    - endpoint.ivanti
    URI|contains:
    - /api/v2/users/
    - /api/v2/roles/
    - /admin/user/
    HTTPMethod: POST
    RequestBody|contains:
    - admin
    - administrator
    - privilege
    - role
  filter_audit_service:
    UserAgent|contains:
    - Ivanti
    - automation
  condition: selection and not filter_audit_service
falsepositives:
- Legitimate admin provisioning workflows via API
- Scheduled role sync from identity management systems
level: medium
id: 539f6230-075e-54fc-9623-42530d1eee98
status: experimental
author: Vorant

Ivanti EPMM Unauthorized Configuration or Policy Modification

ATT&CK T1068

Detects API calls to Ivanti EPMM configuration or policy endpoints from non-administrative sessions, indicating privilege escalation via authorization bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Ivanti EPMM Unauthorized Configuration or Policy Modification
description: Detects HTTP requests to Ivanti EPMM policy, device management, or system
  configuration endpoints from sessions that lack the necessary administrative authorization
  level, exploiting CVE-2026-18851 bypass.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: proxy
  product: ivanti
detection:
  selection:
    DestinationHostname|contains:
    - epmm
    - endpoint.ivanti
    URI|contains:
    - /api/v2/policies/
    - /api/v2/devices/
    - /api/v2/config/
    - /mdm/policy/
    HTTPMethod:
    - POST
    - PUT
    - DELETE
  filter_admin_context:
    UserPrivilegeLevel: admin
  condition: selection and not filter_admin_context
falsepositives:
- Read-only API calls mislogged as write operations
- Service account configurations with broad URI matching
level: medium
id: 0bc843ef-6b38-5eaa-b77c-99683f97c424
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0359.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free