SB20261110343 - Multiple vulnerabilities in Ivanti Endpoint Manager Mobile (formerly MobileIron Core)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110343

SB20261110343 - Multiple vulnerabilities in Ivanti Endpoint Manager Mobile (formerly MobileIron Core)

Published: November 10, 2026

Security Bulletin ID SB20261110343
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2026-105425)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to OS command injection in Ivanti Sentry and Ivanti Endpoint Manager Mobile when processing user-supplied input. A remote privileged user can supply input containing injected operating system commands to execute arbitrary code.


2) Input validation error (CVE-ID: CVE-2026-105426)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to set arbitrary Linux kernel parameters as root.

The vulnerability exists due to improper input validation in Ivanti Endpoint Manager Mobile when processing user-supplied input. A remote privileged user can supply improperly validated parameter values to modify arbitrary Linux kernel parameters with root privileges.


3) Input validation error (CVE-ID: CVE-2026-105427)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to cause a denial of service by permanently disabling all Apache HTTPS services.

The vulnerability exists due to improper input validation in Ivanti Endpoint Manager Mobile when processing user-supplied input. A remote privileged user can supply specially crafted input to permanently disable all Apache HTTPS services and cause a denial of service.


4) Argument injection (CVE-ID: CVE-2026-107404)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to delete arbitrary files on disk.

The vulnerability exists due to argument injection in Ivanti Endpoint Manager Mobile when incorporating user-supplied input into command arguments. A remote privileged user can inject command arguments to delete arbitrary files on disk.


5) Exposed dangerous method or function (CVE-ID: CVE-2026-107405)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to exposure of a dangerous function in Ivanti Endpoint Manager Mobile when permitting local users to invoke that function. A local user can invoke the exposed function to cause a denial of service.


6) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2026-83528)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to disclose personally identifiable user information protected under the GDPR.

The vulnerability exists due to exposure of private personal information in Ivanti Endpoint Manager Mobile when handling user information. A remote privileged user can access exposed personally identifiable information to disclose GDPR-protected user data.


Remediation

Install update from vendor's website.

References