Ivanti Endpoint Manager Mobile contains a code injection flaw that allows attackers to inject and execute arbitrary code without authentication. This weakness, classified as CWE‑94, shows that user‑supplied input is improperly used in a code execution context, enabling a remote attacker to run malicious code on the affected system.

The affected product is Ivanti Endpoint Manager Mobile. No specific version information is supplied, so any deployment of this product is considered potentially vulnerable until detailed assessment confirms otherwise.

The CVSS score of 9.8 reflects critical severity, and the EPSS score of 84% indicates a high probability of exploitation, suggesting that this vulnerability is likely to be attacked in the general population. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, implying that exploitation has been observed. Based on the description, the likely attack vector is the mobile endpoint—by sending crafted requests or API calls that the application does not properly validate—allowing an unauthenticated attacker to trigger code execution and potentially compromise the system.