This vulnerability (CVE-2026-5786) in Ivanti Endpoint Manager Mobile involves improper access control (CWE-284) that permits a remote attacker with authentication privileges to escalate their access to administrative level. The issue affects versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. The CVSS 3.1 base score of 8.8 reflects that the attack vector is network-based, requires low attack complexity, and privileges, with no user interaction needed, resulting in high impact on confidentiality, integrity, and availability.

An authenticated remote attacker can gain administrative access to the affected Ivanti Endpoint Manager Mobile system. This could lead to full control over the system, including unauthorized configuration changes, data exposure, or disruption of service. The high CVSS score indicates a serious risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the management interface to trusted users only and monitor for suspicious activity involving privilege escalation attempts.