Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks

"The exploited flaw, tracked as CVE-2026-6973, is a high-severity improper input validation issue that can be exploited by an authenticated attacker with admin privileges for remote code execution."

"Ivanti says it's aware of a "very limited number of customers" being targeted in attacks exploiting CVE-2026-6973. "If customers followed Ivanti's recommendation in January to rotate credentials if you were exploited with CVE-2026-1281 and CVE-2026-1340, then your risk of exploitation from CVE-2026-6973 is significantly reduced," the vendor noted in its advisory."

"Based on this information, CVE-2026-6973 may have been chained with CVE-2026-1281 or CVE-2026-1340, which allow unauthenticated remote code execution, enabling an attacker to gain complete control of the targeted MDM infrastructure. CVE-2026-1281 and CVE-2026-1340 were initially also leveraged in targeted zero-day attacks, but exploitation surged shortly after their disclosure."

"CISA added CVE-2026-6973 to its KEV catalog on Thursday, instructing federal agencies to address it by May 10. CISA's KEV list currently includes 34 Ivanti product vulnerabilities. Ivanti pointed out in its advisory that the remaining vulnerabilities patched with the latest EPMM updates do not appear to have been exploited in the wild."

Ivanti released May 2026 security updates for Endpoint Manager Mobile to address five vulnerabilities, including a zero-day exploited in targeted attacks. The exploited issue, CVE-2026-6973, is a high-severity improper input validation flaw that an authenticated attacker with admin privileges can use for remote code execution. Ivanti reported that only a very limited number of customers are targeted. The vendor recommended rotating credentials if exploitation occurred with CVE-2026-1281 or CVE-2026-1340, which can enable unauthenticated remote code execution and full control of MDM infrastructure. CISA added CVE-2026-6973 to its KEV catalog with a May 10 remediation deadline. Ivanti stated the other patched vulnerabilities have not been exploited in the wild and include privilege escalation, client certificate access, arbitrary method invocation, and information disclosure.

Read at SecurityWeek