CVE-2026-6973

Ivanti EPMM is software businesses use to manage and secure employee phones and tablets remotely. This flaw means someone who already has an administrator login to the system can trick it into running their own commands — like a building manager's keycard being tricked into unlocking every door in the building, not just the one it's supposed to control. Once exploited, an attacker effectively owns the server managing all your mobile devices.

This matters to you if you run Ivanti Endpoint Manager Mobile (EPMM) to manage company phones or tablets, especially on versions older than 12.6.1.1, 12.7.0.1, or 12.8.0.1. It's relevant whether you manage EPMM in-house or through a third-party IT provider — ask them directly. This is only exploitable by someone who already holds an administrative login to the system, so tightening who has admin access also reduces your risk.

Attackers are already exploiting this vulnerability in real-world attacks, which is why it's on CISA's Known Exploited Vulnerabilities list with a short remediation deadline. This is not a theoretical risk — treat it as an active threat and prioritize the fix immediately, not on your normal patch schedule.

1. Inventory all EPMM instances and confirm version numbers via the admin console or API.
2. Upgrade to the fixed version matching your current branch: 12.6.1.1, 12.7.0.1, or 12.8.0.1 — these are the only vendor-confirmed remediations, there is no workaround alternative noted.
3. Review the vendor advisory (Ivanti May 2026 Security Advisory) for any branch-specific upgrade notes before applying.
4. Audit administrative accounts on EPMM; since exploitation requires authenticated admin-level access, enforce least privilege, rotate admin credentials, and enable MFA on admin accounts if not already in place.
5. CISA remediation due date is 2026-05-10 — treat this as a hard internal deadline for federal-adjacent or regulated environments, and align internal SLAs to it regardless.
6. Monitor EPMM logs for anomalous admin activity, unexpected process execution, or unfamiliar configuration changes following the advisory's IOC guidance if published.
7. No public PoC exploit code is currently on record, but KEV-confirmed in-the-wild exploitation (actor reportedly linked to ShinyHunters per press reporting) means active campaigns exist even without public tooling.

CVSS 7.2 (High) — AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network-reachable but requiring high-privilege (admin) authentication, with no user interaction needed and full impact to confidentiality, integrity, and availability upon success. Weakness is CWE-20 (Improper Input Validation) leading to remote code execution. Confirmed listed in CISA KEV (added 2026-05-07, due 2026-05-10), overriding the EPSS prediction as the authoritative exploitation signal. No public exploit code is currently available, indicating private/targeted exploitation tooling. Press attention is rising, tied to the patch release and an actor (ShinyHunters) referenced in reporting, though this is not independently confirmed as the exploiting party by KEV.