CVE-2026-105813 PUBLISHED

Assigner: ivanti
Reserved: 05.10.2026 Published: 10.11.2026 Updated: 10.11.2026

Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS Score: 6.3

Attack Vector	Local	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Ivanti
Product	User Workspace Manager
Versions	Default: affected Version 2026.4 is unaffected

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-User-Workspace-Manager-CVE-2026-105813?language=en_US

Problem Types

CWE-312 Cleartext storage of sensitive information CWE

Impacts

CAPEC-37 Retrieve Embedded Sensitive Data