Exposure of Private Information ('Privacy Violation') in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) - CVE-2026-83528
Published: November 10, 2026
Vulnerability identifier: #VU164599
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-83528
CWE-ID: CWE-359
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to disclose personally identifiable user information protected under the GDPR.
The vulnerability exists due to exposure of private personal information in Ivanti Endpoint Manager Mobile when handling user information. A remote privileged user can access exposed personally identifiable information to disclose GDPR-protected user data.
Affected software
Ivanti Endpoint Manager Mobile (formerly MobileIron Core)
How to mitigate CVE-2026-83528
Install security update from vendor's website.
Ivanti Endpoint Manager Mobile (formerly MobileIron Core) - addressed in versions 12.9.0.3, 12.10.0.1, 12.11.0.0