CVE-2026-5786

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-578607.8ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcCVE-2026-578628.5Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections byCVE-2026-578638.8Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to writCVE-2026-578668.8Server side request forgery in Apache Impala versions 4.4.x and 4.5.x.  Authenticated Impala users with permissions to execute the ai_generaCVE-2026-578678.8MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targetingCVE-2026-578687.1MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: throCVE-2026-578697.1Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers tCVE-2026-57879.1An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker CVE-2026-578705.3Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other orgaCVE-2026-578717.1Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. CVE-2026-578727.5An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vCVE-2026-578737.5An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and ea
CVE-2026-5786: High severity, CVSS 8.8 | Vulnix