CVE-2019-10885

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-05 · updated 2026-06-17
Weakness: CWE-264

Description

An issue was discovered in Ivanti Workspace Control before 10.3.90.0. Local authenticated users with low privileges in a Workspace Control managed session can bypass Workspace Control security features configured for this session by resetting the session context.

Affected products

Ivanti Workspace Control: before 10.3.90.0 — fixed in 10.3.90.0

How to fix

Upgrade to a fixed version: Ivanti Workspace Control 10.3.90.0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/156792/Ivanti-Workspace-Manager-Security-Bypass.html
https://community.ivanti.com/docs/DOC-74552
http://packetstormsecurity.com/files/156792/Ivanti-Workspace-Manager-Security-Bypass.html
https://community.ivanti.com/docs/DOC-74552

Get alerted when CVE-2019-10885 or the next vulnerability affects your stack