# CVE-2026-10727: Ivanti EPMM OS command injection in management interface

Source: https://junglewise.ai/threats/cve-2026-10727-ivanti-epmm-os-command-injection-in-management-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-10727 · Severity: high · CVSS 7.2 · Published 2026-06-09

Ivanti Endpoint Manager Mobile (EPMM) is a platform used by organizations to manage and secure mobile devices. A security vulnerability has been identified that could allow an administrative user to take full control of the underlying server. If exploited, an attacker could execute unauthorized commands with the highest level of system privileges, potentially leading to data theft or a complete service outage.

Technologies: [Ivanti Endpoint Manager Mobile](https://junglewise.ai/threats/technologies/endpoint-manager-mobile). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-10727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10727 being exploited in the wild.

**How severe is CVE-2026-10727?** High severity, with a CVSS score of 7.2, published 9 June 2026.

**Which products and versions are affected?** Ivanti Endpoint Manager Mobile Before 12.9.0.1, 12.8.0.3, and 12.7.0.2.

**Is there a fix for CVE-2026-10727?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10727 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10727?** Check whether you run Ivanti Endpoint Manager Mobile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2. The flaw is rooted in the improper neutralization of special elements used in OS commands. A remote attacker with high-level administrative privileges can exploit this vulnerability via the network without user interaction. Successful exploitation allows the execution of arbitrary commands with root-level privileges on the underlying operating system. Ivanti has released patches to address this issue in the affected version branches.

## Affected products

- Ivanti Endpoint Manager Mobile (EPMM) Before 12.9.0.1, 12.8.0.3, and 12.7.0.2

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory

## References

- [https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US)

## Related threats

- [Ivanti Endpoint Manager Mobile privilege escalation via missing authorization](https://junglewise.ai/threats/cve-2026-18851-ivanti-endpoint-manager-mobile-privilege-escalation-via-missing)
- [Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-7821-improper-certificate-validation-in-ivanti-epmm-before-versions-12)
- [Ivanti Endpoint Manager Mobile RCE via Apache directive injection](https://junglewise.ai/threats/cve-2026-6973-ivanti-endpoint-manager-mobile-rce-via-apache-directive-injection)
- [An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-5788-an-improper-access-control-in-ivanti-epmm-before-versions-12-6-1-1)
- [An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-5787-an-improper-certificate-validation-in-ivanti-epmm-before-versions)