GCVE-110-NCSC-2026-190

Advisory PublishedCVSS 7.2/10

Vulnetix · Advisory published June 11, 2026

An OS command injection vulnerability in Ivanti EPMM versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2 enables a remote authenticated attacker to execute arbitrary commands with root privileges.

Download JSON Open in Console

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-15External Control of System or Configuration Setting

Risk Scores

CVSS 3.1

7.2/10

High · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Ivanti	vers:unknown/*	—	—

Aliases

CVE-2026-10727 CVE-2026-6973

References

advisory

Browse GCVE Records

74,108 records in the GCVE database · Updated July 20, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON