Ivanti Patches Actively Exploited EPMM Zero-Day Requiring Admin Access
Summary
Ivanti says attackers have exploited CVE-2026-6973, an EPMM flaw requiring authenticated administrative access for remote code execution. It released patches for five vulnerabilities; the company reported very limited exploitation and did not disclose the number of-imp
Key points
- Ivanti reported very limited in-the-wild exploitation of CVE-2026-6973 and did not disclose when exploitation began or how many customers were affected.
- The EPMM zero-day is an improper input validation flaw that allows remote code execution with authenticated administrative privileges.
- Ivanti released patches for five vulnerabilities, including four additional high-severity flaws that it said had not been exploited in the wild.
- CISA added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog within hours of Ivanti's disclosure.
- Ivanti said customers who rotated EPMM credentials following January's vulnerabilities are at significantly reduced risk.
- Earlier EPMM flaws CVE-2026-1281 and CVE-2026-1340 were exploited starting in late January; the article says the fallout reached nearly 100 victims.
Article Details
- Vulnerability Types
- Improper input validation
- Remote code execution
- Code injection
- Severity
- Not disclosed
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Rotate EPMM credentials, as Ivanti recommended in January.
CVE
CVE-2026-1281Ivanti · Endpoint Manager Mobile#IvantiCVE-2026-1340Ivanti · Endpoint Manager Mobile#IvantiCVE-2026-5787Ivanti · Endpoint Manager Mobilereleased patches for all five vulnerabilities Thursday, including the four additional defects — CVE-2026-5787, CVE-2026-5788, CVE-2026-6973 and CVE-2026-7821 — which it said haven’t been exploited in the wild.CVE-2026-5788Ivanti · Endpoint Manager Mobilepatches for all five vulnerabilities Thursday, including the four additional defects — CVE-2026-5787, CVE-2026-5788, CVE-2026-6973 and CVE-2026-7821 — which it said haven’t been exploited in the wild.CVE-2026-6973Ivanti · Endpoint Manager MobileIvanti has disclosed active exploitation of CVE-2026-6973, a zero-day in Endpoint Manager Mobile that lets authenticated administrators execute remote code, and has released patches for five related vulnerabilities.CVE-2026-7821Ivanti · Endpoint Manager MobileThursday, including the four additional defects — CVE-2026-5787, CVE-2026-5788, CVE-2026-6973 and CVE-2026-7821 — which it said haven’t been exploited in the wild.
People
Caitlin CondonVulnCheck vice president of security research; said the administrative privileges required for CVE-2026-6973 suggest it may have been exploited in an attack chain using another method for initial access.Daniel SpicerIvanti chief security officer; discussed the company's approach to disclosing vulnerabilities and communicating with customers and security partners.
Vendors
Products
Countries
ChinaEPMM — CVE-2026-1281 and CVE-2026-1340 — have been exploited by a range of threat actors, including China- and Iran-attributed groups,” Condon told CyberScoop.Iran— CVE-2026-1281 and CVE-2026-1340 — have been exploited by a range of threat actors, including China- and Iran-attributed groups,” Condon told CyberScoop.
Industries
Critical infrastructureThe company, which serves many government agencies and critical infrastructure operators, also routinely notes that highly skilled and resourced attackers, including those backed by nation-states, are often responsibleGovernmentThe company, which serves many government agencies and critical infrastructure operators, also routinely notes that highly skilled and resourced attackers, including those backed by nation-states, are often responsible