An Improper Access Control flaw in Ivanti Endpoint Manager Mobile allows a remote attacker who does not need authentication to call any exposed method of the application. This can lead to unauthorized data access, data modification, or further exploitation of the system depending on the capabilities of the invoked methods. The vulnerability is based on the weakness identified as CWE‑284.

The flaw is present in Ivanti Endpoint Manager Mobile versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Organizations that deploy these earlier releases of the mobile endpoint management solution are therefore susceptible to the described access control bypass.

The CVSS score of 7.0 marks the vulnerability as high severity. No EPSS score is available, so the current exploitation likelihood cannot be quantified, and the flaw is not yet listed in the CISA KEV catalog. Because the attack does not require authentication, a malicious actor can reach the vulnerable API endpoints from outside the network if they are exposed, making remote exploitation straightforward. Immediate patching is recommended to close the control gap and prevent unauthorized method execution.