An improper input validation flaw exists in Ivanti Endpoint Manager Mobile versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. A remotely authenticated administrative user can use this flaw to achieve remote code execution. This vulnerability is linked to CWE‑20.

Ivanti Endpoint Manager Mobile deployments running versions 12.6.1.0, 12.7.0.0, or 12.8.0.0 are vulnerable when remote administrative access is enabled.

The CVSS score of 7.2 classifies the issue as high severity, and the EPSS score of 20% indicates a moderate probability of exploitation. The vulnerability is listed in the CISA KEV catalog, highlighting its active exploitation or high threat perception. Exploitation requires valid administrative credentials, meaning the attacker must first compromise or obtain those credentials, after which remote code execution can be achieved from any remote context.