CVE-2026-6973: high-severity vulnerability in Ivanti Endpoint Manager Mobile
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ivanti EPMM has a flaw where it doesn't properly check user input, allowing an admin account to run malicious code on the system remotely. This is dangerous because attackers who compromise an admin account gain full control of the server.
CWE-20 (Improper Input Validation) in Ivanti EPMM <12.6.1.1, 12.7.0.1, 12.8.0.1 permits remote code execution via authenticated administrative access. Attack vector requires prior admin credential compromise; impact is unrestricted command execution in application context.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.