VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVPublished EPSS 13.6% probability of exploitation in 30 days
Ivanti

CVE-2026-10727: An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote…

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?
13.6%

EPSS score, percentile 96.5 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?
7.2 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Unaffected 12.9.0.1; 12.8.0.3; 12.7.0.2

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

What to do

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Affected products and versions

As listed in the CVE record.

Ivanti Endpoint Manager Mobile
StatusVersions
Unaffected12.9.0.1
Unaffected12.8.0.3
Unaffected12.7.0.2

Versions not listed are: affected.

Versions the record lists as unaffected: 12.9.0.1, 12.8.0.3, 12.7.0.2.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

About this vulnerability

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root

Summary: CVE record, as of .

  • CISA has not added CVE-2026-10727 to its Known Exploited Vulnerabilities (KEV) catalog, as of 28 Oct 2026.
  • The CVE record was published on 9 Jun 2026.
  • The CVE record carries a CVSS v3.1 base score of 7.2 (High), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 13.6% (percentile 96.5), as of 28 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
  • CISA's SSVC assessment in the CVE record: exploitation none, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.

Description

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

Weakness

  • CWE-78: Improper neutralization of special elements used in an OS command ('OS command injection')

Attack patterns (CAPEC)

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published
CVE record last updated

References

Known exploited Ivanti vulnerabilities

  • CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (added )
  • CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability (added )
  • CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability (added )
  • CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability (added )
  • CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability (added )