CVE-2026-8110

Published: May 12, 2026Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 (Secondary)

Description

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.

Affected (9)

Products: Ivanti: Endpoint Manager

Ivanti

1 product

Endpoint Manager

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Ivanti Endpoint Manager	Up to 2022
Ivanti Endpoint Manager	Version 2024
Ivanti Endpoint Manager	Version 2024 su1
Ivanti Endpoint Manager	Version 2024 su2
Ivanti Endpoint Manager	Version 2024 su3
Ivanti Endpoint Manager	Version 2024 su3_security_release_1
Ivanti Endpoint Manager	Version 2024 su4
Ivanti Endpoint Manager	Version 2024 su4_security_release_1
Ivanti Endpoint Manager	Version 2024 su5

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Vendor Advisory

Timeline

No history available yet.