Improper Certificate Validation in Endpoint Manager Mobile (formerly MobileIron Core) - CVE-2026-7821
Published: May 7, 2026
Vulnerability identifier: #VU130639
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-7821
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to enroll a device belonging to a restricted set of unenrolled devices, disclose information about the EPMM appliance, and affect the integrity of the newly enrolled device identity.
The vulnerability exists due to improper certificate validation in Ivanti Endpoint Manager Mobile (EPMM) when processing device enrollment. A remote attacker can submit crafted enrollment material to enroll a device belonging to a restricted set of unenrolled devices, disclose information about the EPMM appliance, and affect the integrity of the newly enrolled device identity.
Only deployments configured to use Apple Device Enrollment are at risk.
Affected software
Endpoint Manager Mobile (formerly MobileIron Core)
How to mitigate CVE-2026-7821
Install security update from vendor's website.
Endpoint Manager Mobile (formerly MobileIron Core) - addressed in versions 12.6.1.1, 12.7.0.1, 12.8.0.1