{"cve":"CVE-2020-15505","nvd":{"published":"2020-07-07T02:15:10.613","modified":"2026-06-17T02:56:45.497","status":"Analyzed","description":"A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-706"],"references":["http://packetstormsecurity.com/files/161097/MobileIron-MDM-Hessian-Based-Java-Deserialization-Remote-Code-Execution.html","https://cwe.mitre.org/data/definitions/41.html","https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/","https://www.mobileiron.com/en/blog/mobileiron-security-updates-available","https://www.mobileiron.com/en/blog/mobileiron-security-updates-available"],"products":["mobileiron:core","mobileiron:enterprise_connector","mobileiron:monitor_and_reporting_database","mobileiron:sentry"],"source":"nvd","synced_at":"2026-10-19T21:06:22.076270124+00:00"},"epss":{"cve":"CVE-2020-15505","score":0.99737,"percentile":0.99954,"date":"2026-11-01"},"kev":{"cve":"CVE-2020-15505","date_added":"2021-11-03","due_date":"2022-05-03","vendor":"Ivanti","product":"MobileIron Multiple Products","known_ransomware":false},"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}