CVE-2026-50209CWE-732

MDM Server Registration Overriding

Critical · published June 4, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-06-04T07:17Z
EPSS history
Timeline
  • 04 JUN 07:17Z
    MDM Server Registration Overriding
    cvelistv5