CVE-2026-18851 is a high-severity vulnerability in Ivanti Endpoint Manager Mobile (EPMM), a widely-deployed mobile device management (MDM) platform used by organizations and government agencies to manage and secure fleets of mobile devices. A missing-authorization flaw allows a remote attacker who already holds authenticated access to escalate their privileges to full administrator level on the EPMM platform. This advisory is issued alongside CERTVU Advisory 315 (Ivanti Neurons for ITSM), disclosed by Ivanti in the same September 2026 security update; EPMM is a distinct product from Neurons for ITSM with its own affected versions and its own fixed release, so it is covered separately here. Ivanti states it has no evidence of this vulnerability being exploited in the wild at the time of disclosure.

Affected systems are any Ivanti EPMM instance running a pre-patch version.

Ivanti EPMM, versions 12.9.0.1 and earlier, and 12.8.0.3 and earlier - (Affected)
Ivanti EPMM, versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 and later - (Not affected, patched)

Any instance reachable from an untrusted network faces high risk once an attacker holds any authenticated account, including a compromised low-privileged one; there is no published workaround in place of upgrading.

No user interaction is required once authenticated access exists. Ivanti reports no evidence of active exploitation at the time of disclosure, but any compromised or low-privileged EPMM account is sufficient to attempt exploitation.

Step 1 - Authenticate to EPMM and Exploit the Missing-Authorization Flaw

A remote attacker who already holds authenticated access to an Ivanti EPMM instance - for example, through a compromised low-privileged account or credentials obtained via phishing - exploits the missing-authorization flaw to bypass the checks that should restrict privileged actions.

Step 2 - Escalate to Administrator-Level Privileges

Successful exploitation escalates the attacker's privileges to full administrator level on the EPMM platform, granting control over the managed mobile device fleet and the MDM configuration itself.

Successful exploitation may allow an attacker to escalate from a low-privileged authenticated account to full administrator level on an Ivanti EPMM instance, gaining administrative control over an organization's managed mobile device fleet and MDM configuration, including the ability to push configuration, applications, or commands to enrolled devices.

CERTVU recommends the following:

1. Apply the Vendor Patch Without Delay

   Upgrade Ivanti EPMM to version 12.10.0.0, 12.9.0.2, or 12.8.0.4 (as applicable to your release line) or later.

2. Review EPMM Accounts and Access Levels

   Review existing EPMM accounts and their assigned privilege levels, disable unused or unnecessary accounts, and rotate credentials for any account suspected of compromise.

3. Restrict Network Exposure of the EPMM Administration Interface

   Limit access to the EPMM administration interface to trusted internal networks or a VPN rather than exposing it directly to the internet.

4. Review EPMM Audit Logs for Unexpected Privilege Changes

   Check EPMM audit logs for unexpected escalations to administrator level or other unauthorized privilege changes.

Report any suspected compromise involving an Ivanti EPMM instance to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.