# CVE-2026-18851: Ivanti Endpoint Manager Mobile privilege escalation via missing authorization

Source: https://junglewise.ai/threats/cve-2026-18851-ivanti-endpoint-manager-mobile-privilege-escalation-via-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18851 · Severity: high · CVSS 8.8 · Published 2026-09-08

Ivanti Endpoint Manager Mobile is a mobile device management solution used by organizations to manage corporate mobile devices and enforce security policies. A missing authorization vulnerability allows authenticated users to escalate their privileges to admin level, potentially giving attackers full control over the device management system if they compromise a standard user account.

Technologies: [Ivanti Endpoint Manager Mobile](https://junglewise.ai/threats/technologies/endpoint-manager-mobile). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-18851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18851 being exploited in the wild.

**How severe is CVE-2026-18851?** High severity, with a CVSS score of 8.8, published 8 September 2026.

**Which products and versions are affected?** Ivanti Endpoint Manager Mobile before 12.10.0.0, 12.9.0.2, and 12.8.0.4.

**Is there a fix for CVE-2026-18851?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18851 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18851?** Check whether you run Ivanti Endpoint Manager Mobile at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization (authorization bypass) vulnerability in Ivanti Endpoint Manager Mobile that affects versions before 12.10.0.0, 12.9.0.2, and 12.8.0.4. A remote authenticated attacker can exploit this flaw to escalate privileges from a regular user account to administrative level. The vulnerability requires prior authentication to the system, but does not require additional user interaction or network-layer exploitation. An attacker who gains a legitimate user account can leverage this flaw to gain full administrative control over the endpoint management system. Patches are available in versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 or later.

## Affected products

- Ivanti Endpoint Manager Mobile before 12.10.0.0, 12.9.0.2, and 12.8.0.4

## Timeline

- 2026-09-08: disclosed

## References

- [https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851?language=en_US](https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851?language=en_US)

## Related threats

- [Ivanti EPMM OS command injection in management interface](https://junglewise.ai/threats/cve-2026-10727-ivanti-epmm-os-command-injection-in-management-interface)
- [Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-7821-improper-certificate-validation-in-ivanti-epmm-before-versions-12)
- [Ivanti Endpoint Manager Mobile RCE via Apache directive injection](https://junglewise.ai/threats/cve-2026-6973-ivanti-endpoint-manager-mobile-rce-via-apache-directive-injection)
- [An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-5788-an-improper-access-control-in-ivanti-epmm-before-versions-12-6-1-1)
- [An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-5787-an-improper-certificate-validation-in-ivanti-epmm-before-versions)