CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM)

What is CVE-2026-6973?

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

CVSS7.2 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Added to KEV2026-05-07

Federal patch deadline2026-05-10

Known ransomware useUnknown

Affected product

Ivanti Endpoint Manager Mobile (EPMM)

Remediation Steps

Apply Ivanti emergency security patches released for EPMM immediately
If patching is not immediately possible, isolate EPMM servers from network access
Implement multi-factor authentication for all EPMM administrative accounts
Monitor authentication logs for suspicious activity and unauthorized access attempts
Enable endpoint detection and response (EDR) monitoring on all connected devices

References

Coverage on defend.network

Vulnerability Priority Report – Week 2 of May 2026 (May 11 – 17)
Palo Alto & Ivanti EPMM RCE exploited; PCPJack worm hits cloud (2026-05-08)

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.