Cyber Posture

CVE-2026-7821

High

Published: 07 May 2026

Published
07 May 2026
Modified
07 May 2026
KEV Added
Patch
CVSS Score 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0004 13.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7821 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Ivanti Endpoint Manager Mobile. Its CVSS base score is 7.4 (High).

Operationally, ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-295

When certificates are used to establish component provenance, the control requires correct certificate validation procedures.

addresses: CWE-295

Mandates approved trust anchors and issuance policies, directly preventing acceptance of unvalidated or untrusted certificates.

addresses: CWE-295

Correct system time is required for proper enforcement of certificate notBefore/notAfter dates and time-based revocation checks.

NVD Description

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the…

more

integrity of the newly enrolled device identity.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)

Affected Products

ivanti
endpoint manager mobile
12.7.0.0, 12.8.0.0 · ≤ 12.6.1.1

CVEs Like This One

CVE-2026-5787Same product: Ivanti Endpoint Manager Mobile
CVE-2026-5786Same product: Ivanti Endpoint Manager Mobile
CVE-2026-6973Same product: Ivanti Endpoint Manager Mobile
CVE-2026-5788Same product: Ivanti Endpoint Manager Mobile
CVE-2026-1340Same product: Ivanti Endpoint Manager Mobile
CVE-2026-1281Same product: Ivanti Endpoint Manager Mobile
CVE-2025-9872Same vendor: Ivanti
CVE-2025-9712Same vendor: Ivanti
CVE-2025-55142Same vendor: Ivanti
CVE-2024-47908Same vendor: Ivanti

References