An improperly implemented access control in Ivanti Endpoint Manager Mobile (EPMM) allows a remote user who has already authenticated to elevate privileges to full administrative level. This flaw, classified as CWE‑284, means that standard user accounts can bypass restrictions and gain control over the mobile console. The vulnerability carries a CVSS score of 8.8, indicating a high‑severity risk that could enable an attacker to modify configurations, view or alter sensitive data, or deploy additional software on managed devices.

The weakness impacts all Ivanti Endpoint Manager Mobile installations with versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Administrators of these release lines must verify their current build and update to a patched release as soon as it becomes available.

The CVSS score of 8.8 reflects a strong potential for privilege escalation. Although an EPSS score is not currently available, the lack of the vulnerability in CISA’s KEV catalog does not diminish its risk; systems that remain on the affected versions remain susceptible to exploitation by any authenticated user. Attackers would need valid credentials, so limiting the attack surface through network segmentation or MFA can reduce exploitation likelihood, but the most effective defense is to apply the vendor‑issued update.