{"id":"CVE-2026-107404","kind":"vulnerability","aliases":["CVE-2026-107404"],"related":[],"title":"Ivanti EPMM: admin argument injection lets attacker delete arbitrary files","description":"Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.","summary":"Ivanti Endpoint Manager Mobile (EPMM) before 12.10.0.1, 12.9.0.3 and 12.8.0.5 has an argument injection flaw. A remote attacker who already holds administrator credentials can delete arbitrary files on the server's disk.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["epmm","ivanti","mobile-device-management","self-hosted","vendor"],"not_affected_if":["fixed-version","no-admin-exposure"],"how_to_check":"- Check the installed EPMM version in the admin console and compare it with the fixed versions below.","fix":"- Upgrade to `12.10.0.1`, `12.9.0.3` or `12.8.0.5` depending on the release line in use.","status":"open","published_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","triaged_at":"2026-11-10T16:23:41+00:00","updated_at":"2026-11-10T16:23:41+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T16:23:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `12.10.0.1`, `12.9.0.3` or `12.8.0.5` depending on the release line in use.","reach":"internet","title":"Ivanti EPMM: admin argument injection lets attacker delete arbitrary files","impact":"medium","summary":"Ivanti Endpoint Manager Mobile (EPMM) before 12.10.0.1, 12.9.0.3 and 12.8.0.5 has an argument injection flaw. A remote attacker who already holds administrator credentials can delete arbitrary files on the server's disk.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ivanti","epmm","mobile-device-management","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker with admin rights deletes arbitrary files on the server","analyst_note":"","how_to_check":"- Check the installed EPMM version in the admin console and compare it with the fixed versions below.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-admin-exposure"],"who_is_affected":"Organizations running Ivanti EPMM on a release before 12.10.0.1, 12.9.0.3 or 12.8.0.5. Exploitation requires an administrator account, so exposure depends on how tightly admin access is controlled. The sources do not say whether default configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4547,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107404':13A,16A '-2026':12A,15A '12.10.0.1':33B,66C '12.8.0.5':36B,69C '12.9.0.3':34B,67C 'admin':3A,76C 'administr':48B 'allow':70C 'alreadi':46B 'arbitrari':9A,52B,80C 'argument':4A,39B,59C 'attack':7A,44B,74C 'authent':73C 'credenti':49B 'cve':11A,14A 'delet':8A,51B,79C 'devic':21B 'disk':58B,83C 'endpoint':28B 'epmm':2A,17B,31B,63C 'file':10A,53B,81C 'flaw':41B 'hold':47B 'host':25B 'inject':5A,40B,60C 'ivanti':1A,18B,27B,62C 'let':6A 'manag':22B,29B 'mobil':20B,30B 'mobile-device-manag':19B 'privileg':77C 'remot':43B,72C 'self':24B 'self-host':23B 'server':56B 'vendor':26B 'version':65C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Ivanti EPMM on a release before 12.10.0.1, 12.9.0.3 or 12.8.0.5. Exploitation requires an administrator account, so exposure depends on how tightly admin access is controlled. The sources do not say whether default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["epmm","ivanti","medium","mobiledevicemanagement","selfhosted","vendor"],"campaign_type":null,"search_a":"'-107404':13A,16A '-2026':12A,15A 'admin':3A 'arbitrari':9A 'argument':4A 'attack':7A 'cve':11A,14A 'delet':8A 'epmm':2A 'file':10A 'inject':5A 'ivanti':1A 'let':6A","search_b":"'12.10.0.1':33B '12.8.0.5':36B '12.9.0.3':34B 'administr':48B 'alreadi':46B 'arbitrari':52B 'argument':39B 'attack':44B 'credenti':49B 'delet':51B 'devic':21B 'disk':58B 'endpoint':28B 'epmm':17B,31B 'file':53B 'flaw':41B 'hold':47B 'host':25B 'inject':40B 'ivanti':18B,27B 'manag':22B,29B 'mobil':20B,30B 'mobile-device-manag':19B 'remot':43B 'self':24B 'self-host':23B 'server':56B 'vendor':26B","search_c":"'12.10.0.1':66C '12.8.0.5':69C '12.9.0.3':67C 'admin':76C 'allow':70C 'arbitrari':80C 'argument':59C 'attack':74C 'authent':73C 'delet':79C 'disk':83C 'epmm':63C 'file':81C 'inject':60C 'ivanti':62C 'privileg':77C 'remot':72C 'version':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107404","severity":null,"published_at":"2026-11-10T16:17:14+00:00","modified_at":"2026-11-10T16:17:14+00:00","first_seen_at":"2026-11-10T16:22:32+00:00","fetched_at":"2026-11-10T16:22:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}