Ivanti Endpoint Manager Mobile contains a code injection flaw that allows attackers to inject arbitrary code and execute it without authentication. This flaw is classified as CWE-94, indicating that the application fails to properly validate or sanitize input before using it in a code context. Because unauthenticated users can trigger code execution, a malicious actor who can reach the vulnerable component can run arbitrary code on the targeted system.

The affected product is Ivanti Endpoint Manager Mobile. No specific version information is supplied, so any deployment of this product is considered potentially vulnerable until a detailed assessment confirms otherwise.

The CVSS score of 9.8 signifies critical severity, and the EPSS score of 66% indicates a high likelihood of exploitation in the general population. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, indicating that active exploitation has been observed. Based on the description, the attack vector is inferred to be through the mobile endpoint, likely via in‑app requests or API calls, and does not require prior authentication. An attacker can exploit the flaw by sending a crafted payload that is executed on the server, leading to remote code execution and full compromise of the system.