# CVE-2026-107404: Ivanti EPMM argument injection in file deletion

Source: https://junglewise.ai/threats/cve-2026-107404-argument-injection-in-ivanti-epmm-before-version-12-10-0-1-12-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-107404 · Severity: medium · CVSS 4.9 · Published 2026-11-10

Ivanti EPMM is a mobile device management platform used by enterprises to manage corporate devices. An authenticated administrator can inject malicious arguments to delete arbitrary files from the server, potentially disabling the system or exposing sensitive data. The vulnerability requires valid admin credentials but allows attackers with those credentials to cause significant harm.

Technologies: [Ivanti EPMM](https://junglewise.ai/threats/technologies/epmm). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-107404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107404 being exploited in the wild.

**How severe is CVE-2026-107404?** Medium severity, with a CVSS score of 4.9, published 10 November 2026.

**Which products and versions are affected?** Ivanti EPMM before 12.10.0.1, before 12.9.0.3, before 12.8.0.5.

**Is there a fix for CVE-2026-107404?** Yes: fixed in EPMM 12.10.0.1, 12.9.0.3, 12.8.0.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107404 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-107404?** Check whether you run Ivanti EPMM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in EPMM 12.10.0.1, 12.9.0.3, 12.8.0.5

## Technical details

An argument injection flaw in Ivanti EPMM allows authenticated administrators to delete arbitrary files on disk through improper input handling. The vulnerability affects versions before 12.10.0.1, 12.9.0.3, and 12.8.0.5, and requires admin-level authentication; an authenticated attacker can invoke file deletion operations by crafting malicious command arguments.

## Affected products

- Ivanti EPMM before 12.10.0.1, before 12.9.0.3, before 12.8.0.5

## Timeline

- 2026-11-10: disclosed

## References

- [https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs](https://hub.ivanti.com/s/article/November-2026-Security-Advisory-Ivanti-EPMM-Multiple-CVEs)

## Related threats

- [Ivanti EPMM PII exposure vulnerability](https://junglewise.ai/threats/cve-2026-83528-exposure-of-pii-in-ivanti-epmm-before-version-12-10-0-1-12-9-0-3)
- [Ivanti EPMM exposed dangerous function denial of service](https://junglewise.ai/threats/cve-2026-107405-an-exposed-dangerous-function-in-ivanti-epmm-before-version-12)
- [Ivanti EPMM improper input validation denial of service](https://junglewise.ai/threats/cve-2026-105427-improper-input-validation-in-ivanti-epmm-before-version-12-10-0)
- [Ivanti EPMM improper input validation kernel parameter modification](https://junglewise.ai/threats/cve-2026-105426-improper-input-validation-in-ivanti-epmm-before-version-12-10-0)
- [Ivanti Sentry and EPMM OS command injection](https://junglewise.ai/threats/cve-2026-105425-os-command-injection-in-ivanti-sentry-before-versions-10-7-4-10)