Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-1340 +1 in the same advisory: …1281 | Unauthenticated Code Injection RCE in Ivanti Endpoint Manager Mobile CVE-2026-1340 is a code injection flaw (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM), Ivanti's enterprise mobile device management platform, that permits unauthenticated remote code execution. Because the flaw is network-reachable and requires no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), a remote attacker can send a crafted request to a vulnerable EPMM server and execute arbitrary code, with high impact to confidentiality, integrity, and availability. Any organization operating an affected EPMM server is affected, especially those exposing the management or device-enrollment interface to the internet. The flaw was added to CISA's KEV catalog on 2026-04-08 with an 86.2% probability of exploitation within 30 days; news reporting describes active zero-day attacks against EPMM (alongside related CVE-2026-6973), including a confirmed Dutch government incident exposing employee contact data, while ransomware use remains unconfirmed. A large share of observed exploit traffic has been traced to a single IP address on bulletproof hosting infrastructure. Do: Apply Ivanti's patched EPMM release per the vendor advisory immediately and verify the fix on any internet-facing EPMM portal; US federal agencies must follow BOD 22-01 mitigation deadlines. Until patched, restrict EPMM portal access to trusted networks/VPNs and review access logs for suspicious requests or unrecognized source IPs, noting that much exploit activity has originated from a single bulletproof-hosting IP. | 9.8 | 86% | KEV |
| large≈ tens of thousands of EPMM server deployments, a large share of them internet-exposed | |
| CVE-2026-5788 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods. An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods. NVD description · AI analysis pending | 9.8 group max | <1% |
| — | ||
| CVE-2026-6973 | Authenticated RCE in Ivanti Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation flaw (CWE-20) that allows a remotely authenticated user with administrative access to achieve remote code execution on the server. An attacker triggers it by sending crafted input to the EPMM management interface after authenticating with administrative credentials, so compromise or misuse of an admin account is the likely path to exploitation. Successful exploitation yields code execution on the EPMM server, giving an attacker a foothold in the organization's mobile device management infrastructure and potential access to data managed through it. Any organization running Ivanti EPMM, typically enterprises using it as their MDM platform, is affected; the available data does not specify affected version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-07, confirming active exploitation (ransomware use unknown), and it carries a high 34.5% EPSS for exploitation in the next 30 days. Do: Update EPMM to the patched release identified in Ivanti's advisory, as required under CISA KEV and BOD 22-01 for federal agencies. Until patched, restrict and audit administrative access to EPMM, review authentication and admin-activity logs for signs of abuse, and limit exposure of the management interface to trusted networks. | 7.2 | 34% | KEV |
| largetens of thousands of EPMM deployments worldwide |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 12.6.1.1 | versions 12.8.0.0 and prior, and has been fixed in versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. These security updates also contai |
| ipv4 | 12.7.0.1 | 2.8.0.0 and prior, and has been fixed in versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. These security updates also contain fixes fo |
Full article458 words · extracted from helpnetsecurity.com · click to collapse
Ivanti has released fixes for 5 high-severity vulnerabilities in its Endpoint Manager Mobile (EPMM) solution, one of which (CVE-2026-6973) has being exploited as a zero-day by attackers.
“We are aware of a very limited number of customers exploited with CVE-2026-6973,” the company said in a security advisory published on Thursday.
About CVE-2026-6973
CVE-2026-6973 is caused by improper input validation and allows remote attackers with administrative privileges to execute arbitrary code on vulnerable instances.
“If customers followed Ivanti’s recommendation in January to rotate credentials if you were exploited with CVE-2026-1281 and CVE-2026-1340, then your risk of exploitation from CVE-2026-6973 is significantly reduced,” the company added.
CVE-2026-1281 and CVE-2026-1340 were also exploited as zero-day vulnerabilities, i.e., before Ivanti was aware of them.
Subsequent reports revealed some of the targets: the European Commission, the Dutch Data Protection Authority (AP) and the Council for the Judiciary (Rvdr), and Valtori, Finland’s central government ICT service center.
The other fixed vulnerabilities
CVE-2026-6973 affects Ivanti EPMM versions 12.8.0.0 and prior, and has been fixed in versions 12.6.1.1, 12.7.0.1, and 12.8.0.1.
These security updates also contain fixes for the other four vulnerabilities, which are at the moment not known to be exploited by attackers:
- CVE-2026-5786 – an improper access control vulnerability exploitable by authenticated attackers and leading to elevation of privileges (to admin)
- CVE-2026-5787 – an improper certificate control vulnerability exploitable without authentication and allowing attacker to obtain valid CA-signed client certificates
- CVE-2026-5788 – an improper access control vulnerability allowing a remote unauthenticated attacker to invoke arbitrary methods
- CVE-2026-7821 – an improper certificate control vulnerability allowing a remote unauthenticated attacker to enroll a device, thus leading to information disclosure about EPMM appliance and affecting the integrity of the newly enrolled device identity
“While CVE-2026-7821 is unauthenticated, if customers have not configured and are not using Apple Device Enrollment they are not at risk from this vulnerability,” the company added.
What to do?
Ivanti advised organizations running EPPM on-premises to:
- Upgrade to a fixed version
- Review accounts with admin rights and rotate those credentials
Though the vulnerabilities don’t affect Sentry – a gateway appliance that secures and manages traffic between mobile devices and backend enterprise systems – customers should also “review the security of the Sentry appliance at the same time as EPMM due to the dependency it has on the EPMM appliance and configuration.”
Unfortunately, there are currently no reliable atomic indicators of compromise that could be used to detect compromise via CVE-2026-6973.
The US Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, and ordered US federal civilian agencies to remediate it within three days.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/05/08/ivanti-epmm-zero-day-cve-2026-6973/