Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin

CVE-2026-1340 is a code injection flaw (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM), Ivanti's enterprise mobile device management platform, that permits unauthenticated remote code execution. Because the flaw is network-reachable and requires no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), a remote attacker can send a crafted request to a vulnerable EPMM server and execute arbitrary code, with high impact to confidentiality, integrity, and availability. Any organization operating an affected EPMM server is affected, especially those exposing the management or device-enrollment interface to the internet. The flaw was added to CISA's KEV catalog on 2026-04-08 with an 86.2% probability of exploitation within 30 days; news reporting describes active zero-day attacks against EPMM (alongside related CVE-2026-6973), including a confirmed Dutch government incident exposing employee contact data, while ransomware use remains unconfirmed. A large share of observed exploit traffic has been traced to a single IP address on bulletproof hosting infrastructure.

Do: Apply Ivanti's patched EPMM release per the vendor advisory immediately and verify the fix on any internet-facing EPMM portal; US federal agencies must follow BOD 22-01 mitigation deadlines. Until patched, restrict EPMM portal access to trusted networks/VPNs and review access logs for suspicious requests or unrecognized source IPs, noting that much exploit activity has originated from a single bulletproof-hosting IP.

An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation flaw (CWE-20) that allows a remotely authenticated user with administrative access to achieve remote code execution on the server. An attacker triggers it by sending crafted input to the EPMM management interface after authenticating with administrative credentials, so compromise or misuse of an admin account is the likely path to exploitation. Successful exploitation yields code execution on the EPMM server, giving an attacker a foothold in the organization's mobile device management infrastructure and potential access to data managed through it. Any organization running Ivanti EPMM, typically enterprises using it as their MDM platform, is affected; the available data does not specify affected version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-07, confirming active exploitation (ransomware use unknown), and it carries a high 34.5% EPSS for exploitation in the next 30 days.

Do: Update EPMM to the patched release identified in Ivanti's advisory, as required under CISA KEV and BOD 22-01 for federal agencies. Until patched, restrict and audit administrative access to EPMM, review authentication and admin-activity logs for signs of abuse, and limit exposure of the management interface to trusted networks.