Is CVE-2026-8109 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8109 being exploited in the wild.

How severe is CVE-2026-8109?

Medium severity, with a CVSS score of 6.5, published 12 May 2026.

Which products and versions are affected?

Ivanti Endpoint Manager Before 2024 SU6.

Is there a fix for CVE-2026-8109?

A patch was published on 2026-05-12: Fix available in version 2024 SU6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8109 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8109?

Check whether you run Ivanti Endpoint Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8109: Ivanti Endpoint Manager exposed dangerous method in Core Server

CVE-2026-8109 · Severity: medium · CVSS 6.5 · Published 2026-05-12

Ivanti Endpoint Manager is a centralized platform used by IT departments to manage and secure various devices across an organization. A vulnerability in the Core Server component allows a logged-in user to access sensitive credentials that they should not be able to see. This could allow an attacker with basic access to escalate their privileges or gain unauthorized access to other systems within the corporate network.

Technologies: Ivanti Endpoint Manager. Vendors: Ivanti.

Quick answers

Is CVE-2026-8109 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8109 being exploited in the wild.
How severe is CVE-2026-8109?: Medium severity, with a CVSS score of 6.5, published 12 May 2026.
Which products and versions are affected?: Ivanti Endpoint Manager Before 2024 SU6.
Is there a fix for CVE-2026-8109?: A patch was published on 2026-05-12: Fix available in version 2024 SU6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8109 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8109?: Check whether you run Ivanti Endpoint Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-749 (Exposed Dangerous Method or Function) exists in the Core Server of Ivanti Endpoint Manager (EPM). The flaw is located in an exposed method that does not properly restrict access to sensitive information. A remote attacker with low-level authenticated access can invoke this method to retrieve access credentials. The issue affects all versions prior to 2024 SU6. Ivanti has released a patch in the 2024 SU6 update to address this exposure.

Affected products

Ivanti Endpoint Manager (EPM) Before 2024 SU6

Timeline

2026-05-12: advisory: Initial advisory published by Ivanti and NVD
2026-05-12: patched: Fix available in version 2024 SU6

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.