Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

Summary: Ivanti is warning that CVE-2026-6973, a high-severity improper input validation flaw (CVSS 7.2) in Endpoint Manager Mobile before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1, has been exploited in a very limited number of attacks in the wild, allowing a remotely authenticated user with administrative access to achieve remote code execution. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply fixes by May 10, 2026.
Key Takeaway: Exploitation requires Admin authentication, so the accounts with the most authority on your EPMM deployment are the ones that open the door, and Ivanti says risk is significantly reduced only for customers who rotated credentials after the earlier CVE-2026-1281 and CVE-2026-1340 exploits.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-1281 CVE-2026-1340 CVE-2026-6973
Related: 83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure Cyber Risks ·
Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates Released Cyber Risks ·
Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere Cyber Risks ·