The flaw is a classic OS command injection (CWE‑78) that allows a remote authenticated attacker to run arbitrary commands with root privileges on Ivanti Endpoint Manager Mobile servers. By sending specially crafted input the attacker can supply operating‑system commands that are executed by the system without proper validation, and this can compromise confidentiality, integrity, and availability of the target system.

Ivanti Endpoint Manager Mobile (EPMM) prior to version 12.9.0.1, 12.8.0.3, and 12.7.0.2 are affected. Based on the description, it is inferred that these releases lack the necessary input sanitization that is required to prevent injection.

The CVSS score of 7.2 indicates a high severity vulnerability. The attack requires authentication, meaning that the threat is limited to users with legitimate access to the EPMM console; however, compromised credentials or phishing could enable exploitation. The EPSS score of 14% indicates a higher likelihood of exploitation, and the vulnerability has not yet been listed in CISA’s Known Exploited Vulnerabilities catalog, so there is no evidence of active exploitation. Proper network segmentation and least‑privilege policies can reduce the likelihood of successful attack, but the potential impact remains significant.