{"id":"EM-20261111-Q2ZU","url":"https://cyber.eventmonitor.net/incident/EM-20261111-Q2ZU/ivanti-epmm-vulnerability-cve-2026-105425/","type":"cve","title":"Ivanti EPMM Vulnerability (CVE-2026-105425)","subtitle":"CVE-2026-105425","subject":"CVE-2026-105425","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-11T13:42:41.000Z","firstSignal":"2026-11-10T16:17:13.410Z","lastSignal":"2026-11-11T13:42:41.000Z","updated":"2026-11-11T15:44:07.320Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T13:42:41.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-11T13:42:41.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T16:17:13.410Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-11T13:42:41.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261111-Q2ZU created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T16:17:13.410Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T16:17:13.410Z","detail":"CVSS 7.2"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T16:17:13.410Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-105425 (CVSS 7.2)","text":"OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105425"},{"at":"2026-11-11T13:42:41.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-105425","text":"### This repository is intended for educational purposes and authorized security testing only.\n\nCVE-2026-105425 -- Ivanti Sentry ( RCE.  CWE-78 / CWE-184, CVSS 7.2.\n\nBoth products expose the MobileIron Configuration Service (\"MICS\") layer.  The\nMICS `handleMessage` configuration endpoint takes an…","url":"https://github.com/mustafasaydam/CVE-2026-105425-PoC"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T16:17:13.410","score":7.2,"severity":"HIGH","desc":"OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.","product":"","seen":1794404383637},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}