cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks

· Original article ↗

Summary

Ivanti patched five EPMM vulnerabilities, including CVE-2026-6973, a high-severity flaw the vendor says was exploited in a very limited number of targeted attacks. CISA added it to KEV and set a May 10 deadline for federal agencies.

Key points

  • Ivanti's May 2026 EPMM updates address five vulnerabilities.
  • CVE-2026-6973 is an improper input validation flaw that requires an authenticated attacker with admin privileges and can enable remote code execution.
  • Ivanti said a very limited number of customers were targeted using CVE-2026-6973.
  • Ivanti said rotating credentials after exploitation of CVE-2026-1281 and CVE-2026-1340 significantly reduces the risk from CVE-2026-6973; the article says the flaws may have been chained.
  • CISA added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog and set May 10 as the remediation deadline for federal agencies.
  • Ivanti said the other patched flaws—CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821—did not appear to have been exploited in the wild.

Article Details

Vulnerability Types
  • Improper input validation
  • Remote code execution
  • Privilege escalation
  • Client certificate acquisition
  • Arbitrary method invocation
  • Information disclosure
Severity
High for CVE-2026-6973; severity of the other vulnerabilities is not stated.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Ivanti said rotating credentials after exploitation of CVE-2026-1281 or CVE-2026-1340 significantly reduces the risk of exploitation from CVE-2026-6973.

CVE

CVE-2026-1281Ivanti · Endpoint Manager Mobilefollowed Ivanti’s recommendation in January to rotate credentials if you were exploited with CVE-2026-1281 and CVE-2026-1340, then your risk of exploitation from CVE-2026-6973 is significantly reduced,” theCVE-2026-1340Ivanti · Endpoint Manager MobileIvanti’s recommendation in January to rotate credentials if you were exploited with CVE-2026-1281 and CVE-2026-1340, then your risk of exploitation from CVE-2026-6973 is significantly reduced,” the vendor noted in itsCVE-2026-5786Ivanti · Endpoint Manager MobileThese security holes are tracked as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788 and CVE-2026-7821, and they can be exploited for privilege escalation, obtaining client certificates, invoking arbitrary methods, andCVE-2026-5787Ivanti · Endpoint Manager MobileThese security holes are tracked as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788 and CVE-2026-7821, and they can be exploited for privilege escalation, obtaining client certificates, invoking arbitrary methods, andCVE-2026-5788Ivanti · Endpoint Manager MobileThese security holes are tracked as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788 and CVE-2026-7821, and they can be exploited for privilege escalation, obtaining client certificates, invoking arbitrary methods, andCVE-2026-6973Ivanti · Endpoint Manager MobileThe exploited flaw, tracked as CVE-2026-6973, is a high-severity improper input validation issue that can be exploited by an authenticated attacker with admin privileges for remote code execution.CVE-2026-7821Ivanti · Endpoint Manager MobileThese security holes are tracked as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788 and CVE-2026-7821, and they can be exploited for privilege escalation, obtaining client certificates, invoking arbitrary methods, and

Vendors

IvantiIvanti on Thursday published its May 2026 security updates for the Endpoint Manager Mobile (EPMM) product to address five vulnerabilities, including a zero-day exploited in targeted attacks.

Products

Endpoint Manager Mobile (EPMM)Ivanti on Thursday published its May 2026 security updates for the Endpoint Manager Mobile (EPMM) product to address five vulnerabilities, including a zero-day exploited in targeted attacks.

Related Articles