🚨 Ivanti EPMM Zero-Day Under Attack Ivanti has disclosed a new security vulnerability in Endpoint Manager Mobile that is being exploited in limited attacks. The flaw, tracked as CVE-2026-6973 with a CVSS score of 7.2, allows a remotely authenticated user with administrative access to execute code on the system. Successful exploitation requires valid admin credentials, meaning attackers must already have access before using this flaw. The Vulnerability 🔴 CVE-2026-6973 – CVSS 7.2. Improper input validation in EPMM versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. Remote authenticated user with admin access can achieve remote code execution. Attacker must already have administrative credentials. 📜 Critical Context Ivanti recommended in January that customers rotate credentials if they were exploited with CVE-2026-1281 and CVE-2026-1340. Organizations that followed that guidance have significantly reduced risk. The attacker needs admin access; credential rotation blocks the prerequisite. Exploitation Status Limited attacks observed in the wild. Unknown who is behind the exploitation. Unknown end goals of the attacks. US CISA Action Added to Known Exploited Vulnerabilities catalog. Federal agencies must apply fixes by May 10, 2026. 🩹 Additional Patched Flaws CVE-2026-5786 (CVSS 8.8): Improper access control allowing remote authenticated attacker to gain admin access. CVE-2026-5787 (CVSS 8.9): Improper certificate validation allowing unauthenticated attacker to impersonate Sentry hosts and obtain valid CA-signed client certificates. CVE-2026-5788 (CVSS 7.0): Improper access control allowing unauthenticated attacker to invoke arbitrary methods. CVE-2026-7821 (CVSS 7.4): Improper certificate validation allowing unauthenticated attacker to enroll restricted devices, leading to information disclosure. 🛡️ Mitigations Apply available security patches to all EPMM on-premises instances immediately. Monitor Apache access logs for signs of attempted or successful exploitation. Implement network segmentation to restrict EPMM administrative interfaces to trusted networks only. Review and harden mobile device management policies. This RCE requires admin privileges. The January credential rotation advice directly reduces exposure. Organizations that did not rotate credentials remain at higher risk.
Post summary
CVE-2026-6973 is a CVSS 7.2 remote code execution flaw in Ivanti EPMM, actively exploited in limited attacks, requiring admin credentials, and mitigated by patching and credential rotation.
