Input validation error in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) - CVE-2026-105426
Published: November 10, 2026
Vulnerability identifier: #VU164595
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105426
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to set arbitrary Linux kernel parameters as root.
The vulnerability exists due to improper input validation in Ivanti Endpoint Manager Mobile when processing user-supplied input. A remote privileged user can supply improperly validated parameter values to modify arbitrary Linux kernel parameters with root privileges.
Affected software
Ivanti Endpoint Manager Mobile (formerly MobileIron Core)
How to mitigate CVE-2026-105426
Install security update from vendor's website.
Ivanti Endpoint Manager Mobile (formerly MobileIron Core) - addressed in versions 12.9.0.3, 12.10.0.1, 12.11.0.0