This vulnerability (CVE-2026-10727) involves improper neutralization of special elements used in OS commands (CWE-78) within Ivanti Endpoint Manager Mobile. Specifically, versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2 are affected. An authenticated remote attacker can exploit this flaw to execute arbitrary OS commands as root, potentially compromising the entire system. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows a remote authenticated attacker to execute arbitrary commands with root privileges on the affected system. This can lead to full system compromise, including unauthorized access, data modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Ivanti Endpoint Manager Mobile versions to trusted users only and monitor for unusual activity. Avoid exposing the management interface to untrusted networks.