CVE-2026-6973: Ivanti EPMM improper input validation enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows remote code execution on a management server, is listed in CISA KEV with a three-day remediation deadline, and has a high EPSS score, indicating active exploitation risk.

What it is

Ivanti Endpoint Manager Mobile (EPMM) before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 contains an improper input validation flaw (CWE-20) that lets a remotely authenticated administrative user achieve remote code execution. Because the vulnerable component is a mobile device management server, successful exploitation gives an attacker a foothold with broad control over managed endpoints.

Impact

An attacker with administrative access gains remote code execution on the EPMM server, allowing arbitrary commands and potential compromise of the management infrastructure and the devices it manages.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but exploitation requires high privileges (PR:H), meaning a valid administrative account or equivalent access is needed.

Exploitation

CVE-2026-6973 was added to CISA KEV on 2026-05-07 with a remediation due date of 2026-05-10, indicating known exploitation in the wild; EPSS gives a 30-day probability of 0.34454 (98.3rd percentile). No ransomware campaign use is documented.

What to do

• Upgrade EPMM to 12.6.1.1, 12.7.0.1, or 12.8.0.1 (or later) as directed by the Ivanti advisory.
• If patching is not immediately possible, apply the vendor's mitigations or discontinue use of the product per CISA BOD 22-01 guidance.
• Restrict and audit administrative access to EPMM; enforce least privilege and strong authentication for admin accounts.
• Monitor for and rotate credentials of any administrative accounts that may have been exposed or misused.

Detection

• Review EPMM server logs for unexpected command execution, process creation, or anomalous admin activity around the time of suspected exploitation.
• Alert on administrative logins from unusual source IPs or at unusual times, and on changes to EPMM configuration or managed-device policies.
• Hunt for outbound connections or file writes from the EPMM host that are inconsistent with normal management operations.
• Correlate EPMM audit logs with endpoint telemetry to detect post-exploitation activity on managed devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.