SOCRadarAmeer Owda
CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMM
CVE-2026-6973 is a high-severity remote code execution flaw in Ivanti Endpoint Manager Mobile (EPMM) on-prem deployments that becomes accessible only after remote authentication with administrative privileges. Ivanti has patched the vulnerability and public reporting notes that exploitation has occurred in the wild, with government and prioritisation signals urging rapid remediation.
The advisory scope confirms the vulnerability affects on‑prem EPMM, while other Ivanti products such as Ivanti Neurons for MDM (cloud) are out of scope for this advisory set. The fixed releases are 12.6.1.1, 12.7.0.1, and 12.8.0.1, and users on 12.6.x, 12.7.x, or 12.8.0[.]0 should treat the flaw as vulnerable until updated.
According to CISA KEV, there is a specific patch window with a deadline of 10 May 2026 for federal agencies, and as of 7 May 2026 Shadowserver tracked over 800 internet‑exposed Ivanti EPMM instances globally. Defenders are advised to prioritise patching, audit admin access, rotate credentials, and monitor for unusual admin activity.
AI summary of the original article from SOCRadar, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made
Story timeline CVE-2026-6973
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 7 May · 18:41 UTC | Security Affairs | CISA flags Ivanti EPMM zero day CVE‑2026‑6973, urges May 10 patch |
| Thu 7 May · 18:41 UTC | The Hacker News | Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access |
| Thu 7 May · 22:12 UTC | CISA | CISA flags Ivanti EPMM flaw CVE-2026-6973 as actively exploited |
| Thu 7 May · 22:36 UTC | CISA | Ivanti EPMM flaw CVE-2026-6973 lets admins execute code remotely |
| Fri 8 May · 05:50 UTC | SecurityWeek | Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacks |
| Fri 8 May · 10:58 UTC | SOCRadar | CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMM (this article) |
| Mon 11 May · 14:01 UTC | The Hacker News | Ivanti EPMM and PAN OS flaws hit as patches roll out mid May |