Ivanti EPMM Improper Certificate Validation Vulnerability Allowing Sentry Host Impersonation

A vulnerability exists in Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1, allowing remote unauthenticated attackers to impersonate registered Sentry hosts and obtain valid CA-signed client certificates. This issue arises from improper validation of certificates, enabling the exploitation of the trust relationship between the EPMM server and Sentry hosts.

Impact

Exploitation of this vulnerability allows for the unauthorized issuance of CA-signed client certificates, which could be used to impersonate Sentry hosts in communications with the EPMM server.

Remediation

Users can update to Ivanti EPMM versions 12.6.1.1, 12.7.0.1, or 12.8.0.1, all of which are available through the Ivanti Download Portal. Customers should also review and rotate admin credentials if necessary.