CVE Program Container

Why this deserves its current priority

A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Ivanti/EPMM (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Ivanti/EPMM.
2. 2Review the reported fix. Update Ivanti/EPMM to 11.10.0.3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 3, 2023

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jan 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   May 24, 2026

4. Added to CISA KEV

   Jul 31, 2023

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referenceforums.ivanti.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov

Related CVEs

• rclone before 1.75.1 Path Traversal via Directory Listing NamesAlso CWE-22
• QloApps through 1.7.0 Arbitrary File Read via getEmailHTMLAlso CWE-22
• Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path TraversalAlso CWE-22
• OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' SettingSame generic ecosystem
• YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX ActionSame generic ecosystem
• YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User InputSame generic ecosystem