An exposed method in Ivanti Desktop and Server Management is documented as CWE‑749, indicating an insecure design flaw that allows a local authenticated user to perform actions beyond intended permissions. This flaw can be exploited to elevate privileges within the DSM application, enabling execution of arbitrary code with higher rights. Because the method is accessible to legitimate users, the attack requires only local authentication and bypasses normal authorization controls, potentially compromising the entire server environment.

Ivanti Desktop and Server Management, version ranges before 2026.1.1 are affected. Any deployment of the DSM product prior to the 2026.1.1 release is vulnerable.

The vulnerability carries a CVSS score of 7.8, indicating moderate to high severity. EPSS is less than 1%, suggesting low exploitation probability at present, and the issue is not listed in CISA’s known‑exploited vulnerabilities catalog. Attackers must have local authenticated access, but once they do, privilege escalation is achievable without needing remote code execution. The risk is therefore primarily limited to systems where local users have elevated privileges. Organizations with strict local user controls and prompt patching can mitigate the threat.