CVE-2026-6973

CVE Enrichment

CVSS: 7.2 HIGH
EPSS: 34.45%
EPSS Percentile: 98.42%
CISA KEV: YES — Known Exploited Vulnerability

Description

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Published: 07-May-2026 23:16
Last Modified: 27-Oct-2026 03:10
EPSS Date: 2026-11-03
CWE: CWE-20

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:H /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-05-07
Remediation Due: 2026-05-10
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2026-6973

CNA Products / Version Status

Ivanti · Endpoint Manager Mobile Source: CNA · 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Default status: affected

12.8.0.1 — unaffected (custom)
12.7.0.1 — unaffected (custom)
12.6.1.1 — unaffected (custom)

Affected Products / Versions

ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 12.6.1.1
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*
ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: 12.7.0.0
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*
ivanti / endpoint_manager_mobile Source: NVD CPE · affected
Version / affected range: 12.8.0.0
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.8.0.0:*:*:*:*:*:*:*

References

Last enrichment sync: 04-Nov-2026 09:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

federal agencies to patch an actively exploited zero-day in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-6973, within four days due to the risk of remote code execution on exposed systems. CISA Gives Federal Agencies Four Days to Patch Actively Exploited Ivanti EPMM Flaw
The exploited flaw, tracked as CVE-2026-6973, is a high-severity improper input validation issue that can be exploited by an authenticated attacker with admin privileges for remote code execution. Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks
Ivanti has disclosed active exploitation of CVE-2026-6973, a zero-day in Endpoint Manager Mobile that lets authenticated administrators execute remote code, and has released patches for five related vulnerabilities. Ivanti Patches Actively Exploited EPMM Zero-Day Requiring Admin Access
Ivanti warned customers to patch CVE-2026-6973, a high-severity remote code execution flaw in Endpoint Manager Mobile (EPMM) that has been exploited in zero-day attacks and affects EPMM 12.8.0.0 and earlier. Ivanti Patches EPMM Zero-Day RCE Exploited in Limited Attacks

CVE (6)

People (2)

Vendors (1)

Products (2)

Industries (2)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.