Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

"Ivanti is warning that a new security flaw impacting Endpoint Manager Mobile (EPMM) has been explored in limited attacks in the wild. The high-severity vulnerability, CVE-2026-6973 (CVSS score: 7.2), is a case of improper input validation affecting EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. It allows "a remotely authenticated user with administrative access to achieve remote code execution," Ivanti said in an advisory released today."

""We are aware of a very limited number of customers exploited with CVE-2026-6973. Successful exploitation requires Admin authentication. If customers followed Ivanti's recommendation in January to rotate credentials if you were exploited with CVE-2026-1281 and CVE-2026-1340, then your risk of exploitation from CVE-2026-6973 is significantly reduced.""

"The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the flaw to its Known Exploited Vulnerabilities ( KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by May 10, 2026. Also patched by Ivanti in EPMM are four other flaws - CVE-2026-5786 (CVSS score: 8.8) - An improper access control vulnerability that allows a remote authenticated attacker to gain administrative access."

"CVE-2026-5787 (CVSS score: 8.9) - An improper certificate validation vulnerability that allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates. CVE-2026-5788 (CVSS score: 7.0) - An improper access control vulnerability that allows a remote unauthenticated attacker to invoke arbitrary methods. CVE-2026-7821 (CVSS score: 7.4) - An improper certificate validation vulnerability that allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unen"

Ivanti reports a high-severity security flaw in Endpoint Manager Mobile (EPMM) that has been seen in limited attacks. CVE-2026-6973, with a CVSS score of 7.2, involves improper input validation in EPMM versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. The vulnerability allows a remotely authenticated user with administrative access to achieve remote code execution. Ivanti notes only a very limited number of customers were exploited and that exploitation requires admin authentication. Ivanti also patched four additional vulnerabilities affecting access control and certificate validation, including issues that allow administrative access, impersonation of Sentry hosts, arbitrary method invocation, and enrollment of devices from a restricted set. CISA added CVE-2026-6973 to its KEV catalog, requiring FCEB agencies to apply fixes by May 10, 2026.

Read at The Hacker News