CVE-2026-105813 · Vendor
NO FIX YET · SEE WHAT TO DO
Ivanti UWM before version 2026.4 stores sensitive data in cleartext. A local authenticated attacker can read another local user's session token.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Ivanti UWM installs before 2026.4 are affected, and only where a local, already-logged-in user can read another local user's session token. Systems without local user accounts sharing the host are less exposed. The sources do not give further detail on configuration.
Not affected if auth-required, single-user-host
Who cares ivanti-uwm, windows
2026.4 or later (per the source description)Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.