In CISA KEV7.2 HighCWE-20
CVE-2026-6973
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
IvantiEndpoint Manager Mobile (EPMM)
Status
- Exploited in the wild
- In CISA KEV since 7 May
- Vendor fix available
- Associated threat actor: ShinyHunters
Federal deadlineSun 10 May, 23:59 UTC
Passed 167 days ago
CISA KEV · added 7 May
Exploit probabilityEPSSchecked 25 Oct
34%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
SeverityCVSS
7.2High
Description NVD
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 7 May · 18:41 UTC | Security Affairs | CISA flags Ivanti EPMM zero day CVE‑2026‑6973, urges May 10 patch |
| Thu 7 May · 18:41 UTC | The Hacker News | Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access |
| Thu 7 May · 22:12 UTC | CISA | CISA flags Ivanti EPMM flaw CVE-2026-6973 as actively exploited |
| Thu 7 May · 22:36 UTC | CISA | Ivanti EPMM flaw CVE-2026-6973 lets admins execute code remotely |
| Fri 8 May · 05:50 UTC | SecurityWeek | Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacks |
| Fri 8 May · 10:58 UTC | SOCRadar | CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMM |
| Mon 11 May · 14:01 UTC | The Hacker News | Ivanti EPMM and PAN OS flaws hit as patches roll out mid May |
- Ivanti EPMM and PAN OS flaws hit as patches roll out mid MayThe Hacker News
- CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMMSOCRadar
- Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacksSecurityWeek
- Ivanti EPMM flaw CVE-2026-6973 lets admins execute code remotelyCISA · official notice
- CISA flags Ivanti EPMM flaw CVE-2026-6973 as actively exploitedCISA · official notice
- Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level AccessThe Hacker News
- CISA flags Ivanti EPMM zero day CVE‑2026‑6973, urges May 10 patchSecurity Affairs · first in our coverage