← Back to Vulnerability Reports CVE Intelligence

CVE-2026-6973

Ivanti Endpoint Manager Mobile (EPMM)•HIGH · CVSS 7.2• In the wild In CISA KEV

What is CVE-2026-6973?

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

CVSS7.2 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS3% · P85

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWECWE-20

NVD published2026-05-07

NVD last modified2026-06-17

Timeline

2026-05-07Published to the U.S. National Vulnerability Database (NVD)
2026-05-07Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-05-08First covered in a defend.network daily briefing
2026-05-10CISA federal remediation deadline (BOD 22-01)
2026-06-17NVD record last updated

CISA Known Exploited Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Added to KEV2026-05-07

Federal patch deadline2026-05-10

Known ransomware useUnknown

Affected product

Ivanti Endpoint Manager Mobile (EPMM)

Remediation Steps

Apply Ivanti emergency security patches released for EPMM immediately
If patching is not immediately possible, isolate EPMM servers from network access
Implement multi-factor authentication for all EPMM administrative accounts
Monitor authentication logs for suspicious activity and unauthorized access attempts
Enable endpoint detection and response (EDR) monitoring on all connected devices

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of May 2026 (May 11 – 17)
Palo Alto & Ivanti EPMM RCE exploited; PCPJack worm hits cloud (2026-05-08)

Related vulnerabilities

CVE-2026-104935 – Ivanti Connect Secure (same vendor)
CVE-2026-10520 – Ivanti Sentry (same vendor)
CVE-2026-8043 – Ivanti Xtraction (same vendor)
CVE-2026-99999 (same weakness: CWE-20)
CVE-2026-88771 – Citrix NetScaler (same weakness: CWE-20)
CVE-2026-93952 – Arista VeloCloud Orchestrator (same weakness: CWE-20)

Ivanti: 36 known exploited vulnerabilities (CISA KEV) →

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.