An improper certificate validation flaw in Ivanti Endpoint Manager Mobile allows a remote unauthenticated attacker to impersonate registered Sentry hosts. By forging the identity of a legitimate host, the attacker can obtain valid client certificates that are signed by trusted Certificate Authorities. The capability to acquire these certificates can enable the attacker to authenticate as the client, tamper with or intercept communication, and potentially gain unauthorized access to managed endpoints.

The vulnerability affects Ivanti Endpoint Manager Mobile deployments running any of the following pre‑release versions: 12.6.0.x, 12.6.1.0, 12.7.0.0, 12.7.0.0‑x, 12.8.0.0, and all releases prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. These versions do not enforce strict certificate validation when communicating with Sentry hosts.

With a CVSS score of 8.9, the flaw is rated as high severity. Because the attack vector is remote and requires no authentication, an attacker can target any exposed Endpoint Manager Mobile instance that accepts Sentry host connections. No EPSS data is available, and the vulnerability is not listed in CISA KEV, but the absence of a known fix does not reduce the likelihood of exploitation. An attacker can exploit this weakness by initiating a connection as a legitimate Sentry host and capturing or issuing client certificates that are trusted by the endpoint.