# CVE-2026-5788: An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…

Source: https://junglewise.ai/threats/cve-2026-5788-an-improper-access-control-in-ivanti-epmm-before-versions-12-6-1-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07  
License: CC BY 4.0 with a link back

CVE-2026-5788 · Severity: high · CVSS 7 · Published 2026-05-07

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.

Technologies: [Ivanti Endpoint Manager Mobile](https://junglewise.ai/threats/technologies/endpoint-manager-mobile). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-5788 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5788 being exploited in the wild.

**How severe is CVE-2026-5788?** High severity, with a CVSS score of 7, published 7 May 2026.

**Which products and versions are affected?** Ivanti Endpoint Manager Mobile. The advisory does not name versions.

**Is there a fix for CVE-2026-5788?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-5788?** Check whether you run Ivanti Endpoint Manager Mobile. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Ivanti Endpoint Manager Mobile

## Related threats

- [Ivanti Endpoint Manager Mobile privilege escalation via missing authorization](https://junglewise.ai/threats/cve-2026-18851-ivanti-endpoint-manager-mobile-privilege-escalation-via-missing)
- [Ivanti EPMM OS command injection in management interface](https://junglewise.ai/threats/cve-2026-10727-ivanti-epmm-os-command-injection-in-management-interface)
- [Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-7821-improper-certificate-validation-in-ivanti-epmm-before-versions-12)
- [Ivanti Endpoint Manager Mobile RCE via Apache directive injection](https://junglewise.ai/threats/cve-2026-6973-ivanti-endpoint-manager-mobile-rce-via-apache-directive-injection)
- [An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote…](https://junglewise.ai/threats/cve-2026-5787-an-improper-certificate-validation-in-ivanti-epmm-before-versions)