CVE-2026-6973
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Description
CVE-2026-6973 is a HIGH severity Improper Input Validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM), an enterprise unified-endpoint-management platform used to provision, secure, and configure corporate mobile fleets. The flaw, present in EPMM versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1, allows a remotely authenticated user with administrative access to achieve remote code execution on the EPMM server with a CVSS 3.1 score of 7.2. Successful exploitation grants the attacker code execution on the management server that controls every enrolled mobile device in the estate, including the certificate authority, MDM policies, and app distribution. CISA added CVE-2026-6973 to the KEV catalog on May 7, 2026, with a three-day remediation deadline of May 10, 2026, signalling observed exploitation in the wild. The EPSS score of 0.050 (89.8 percentile) reflects elevated exploitation pressure relative to the broader CVE population.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | < 12.6.1.1; 12.7.0.0; 12.8.0.0 |
References
Weakness Type
CWE-20: Improper Input Validation
CWE-20 describes a class of flaws where a product fails to validate, or incorrectly validates, input that influences the control flow or data passed to sensitive operations. In CVE-2026-6973, an Ivanti EPMM administrative endpoint accepts attacker-influenced input and passes it to a sink that ultimately executes code, without sufficient checks to ensure the input belongs to the expected domain. The bug is reachable to remotely authenticated users with administrative privileges, so it is not directly a pre-auth issue. However, EPMM administrator accounts are high-value targets that are routinely the focus of phishing, credential stuffing, and lateral-movement chains, and any successful compromise of an administrator account converts directly into full code execution on the server.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2026-6973 carries a CVSS 3.1 score of 7.2 (HIGH) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The High privileges-required attribute caps the score below the unauthenticated-RCE band, but the impact ratings remain uniformly High on Confidentiality, Integrity, and Availability. EPMM is the management plane for every enrolled mobile device in the deployment: an attacker with code execution on the EPMM server can read and modify MDM configuration policies, push arbitrary applications to managed devices, extract device certificates and VPN profiles, alter compliance and conditional-access decisions, and exfiltrate corporate data flowing through the platform. EPMM is integrated into identity and access workflows in most environments, so a compromised EPMM server is also a stepping stone into corporate SSO, Active Directory, and the mobile-app footprint of the organization. The historical record on Ivanti EPMM (and its predecessor MobileIron Core) shows that CVEs in this product line are routinely chained with other Ivanti issues to reach pre-authenticated remote code execution.
Exploit Maturity
Public Exploits: No public proof-of-concept code has been released at the time of writing, and Ivanti has published the vulnerability through its May 2026 EPMM security advisory which covers multiple CVEs in the same release cycle. Historical Ivanti EPMM CVEs have routinely been reverse-engineered from patches within days, so exploit code is expected to surface quickly. Active Exploitation: CISA added CVE-2026-6973 to the KEV catalog on May 7, 2026, with a remediation deadline of May 10, 2026. The three-day timeline signals confirmed exploitation against deployed EPMM instances. Exploitation Probability: The EPSS score of 0.050 (89.8 percentile) places this CVE well above the population baseline despite the privileges-required mitigation. Practical Risk: EPMM administrator credentials are recurring targets of credential-stuffing and phishing campaigns. Where an organization has not enforced phishing-resistant MFA on EPMM admin accounts, the privileges-required barrier is fragile and exploitation should be assumed feasible against any unpatched EPMM server.
Remediation
- Upgrade Ivanti EPMM to a patched release immediately. Fixed versions are 12.6.1.1, 12.7.0.1, and 12.8.0.1 across the supported maintenance branches. Confirm the running version on every EPMM server (primary and disaster-recovery pairs) and on any Sentry, Cloud, or Connector components in the deployment, following the procedure in the Ivanti May 2026 security advisory.
- Harden EPMM administrator authentication. Because the vulnerability requires administrative privileges, the highest-impact compensating control is making administrator credentials unreachable to attackers. Enforce phishing-resistant MFA (FIDO2 hardware keys, platform passkeys, or smart cards) on every EPMM administrator account. Disable password-only authentication for the admin interface and require an authenticated VPN or zero-trust access broker in front of the EPMM management URL.
- Hunt for compromise. Audit EPMM admin login logs from at least April 1, 2026 for unusual successful authentications, sessions from unfamiliar IP ranges, or new administrator accounts. Inspect EPMM server filesystems for unexpected files in web roots, unusual scheduled tasks, and altered configuration files. Review MDM policy and app-deployment changes for entries that do not map to a known change request.
- Reduce administrative privilege scope. Apply least-privilege role assignments on the EPMM platform: tier administrator accounts by function (device support, policy management, integration), restrict the highest-privilege roles to a small named group, and review delegated administration grants quarterly.
- Long-term hardening. Apply CWE-20 mitigation principles to internal management interfaces: every parameter must be validated against an explicit allowlist before reaching sensitive operations, particularly on endpoints that touch process execution or file paths. Integrate Ivanti security advisories into a fast-track patch lane with a 72-hour SLA given the consistent pattern of KEV-listed CVEs in the Ivanti EPMM product line.
Technical Details
CVE-2026-6973 is a CWE-20 Improper Input Validation flaw in Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable issue that requires an authenticated administrative session but no user interaction and yields code execution with the privileges of the EPMM application process. EPMM is built on a Java-based application stack with a web administration interface that exposes management endpoints for device, policy, certificate, and app operations; the vulnerable endpoint accepts attacker-controlled input that is not adequately validated before being passed to a sink that ultimately triggers code execution. The fix in the patched releases introduces stricter input validation on the affected endpoint. EPMM has a notable history of CVEs in the same general region of the codebase (CVE-2023-35078, CVE-2023-35081, CVE-2024-22026, and others), so vendors and defenders alike treat EPMM CVE disclosures with elevated urgency: the codebase carries long-lived patterns that have historically been reachable in unanticipated ways, including chains that lower the privilege requirement from administrative to unauthenticated.
Frequently Asked Questions
Is CVE-2026-6973 being actively exploited?
Yes. CISA added CVE-2026-6973 to the KEV catalog on May 7, 2026, with a three-day remediation deadline of May 10, 2026. The KEV listing and short deadline are evidence of confirmed exploitation in production environments. The EPSS score of 0.050 (89.8 percentile) reflects elevated exploitation pressure relative to the average CVE.
What Ivanti EPMM versions are affected?
All EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1 are vulnerable. The fix is shipped in those three patched releases across the supported maintenance branches. Verify the version on every EPMM server (production, DR, sandbox) and any auxiliary components such as Sentry or Cloud connectors.
How do I fix CVE-2026-6973?
Upgrade EPMM to 12.6.1.1, 12.7.0.1, or 12.8.0.1 per your maintenance branch, then enforce phishing-resistant MFA on every EPMM administrator account to make the privileges-required barrier robust, audit admin login logs and MDM configuration history for indicators of compromise back to at least April 1, 2026, and place the EPMM management URL behind a VPN or zero-trust access broker.
Does the administrative privilege requirement actually mitigate this CVE?
It reduces the attacker pool to those who have already compromised an EPMM admin credential, but EPMM admin accounts are routine targets of phishing and credential-stuffing. If password-only authentication is in use, the barrier is fragile. Combined with the historical pattern of chained CVEs against Ivanti EPMM, defenders should treat the privileges-required attribute as a marginal mitigation, not a structural one.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.