KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-6973
7.2
3-Day Required
KEV
Active Exploitation
Details
VulnerabilityIvanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
VendorIvanti
ProductEndpoint Manager Mobile (EPMM)
Date added2026-05-07
Due date2026-05-10
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-20
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
NVD: An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-06-15 02:03 UTC
Wall time45.0s
Searches5
Component defaultunknown
Sources
https://nvd.nist.gov/vuln/detail/CVE-2026-6973
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US
https://www.ivanti.com/blog/may-2026-epmm-security-update
https://kudelskisecurity.com/research/ivanti-epmm-cve-2026-6973-allows-rce-with-admin-credentials-under-active-exploitation
https://zeropath.com/blog/cve-2026-6973-ivanti-epmm-authenticated-rce
https://ctipilot.ch/briefs/2026-05-08/cve-2026-6973-ivanti-epmm-admin-api-improper-input-validation-rce-cvss-7-2-cisa/
https://pragma-core.com/blog/cve-2026-6973-ivanti-epmm-rce-actively-exploited-in-the-wild-and-already-in-cisa-kev
https://ccb.belgium.be/advisories/warning-authenticated-remote-code-execution-vulnerability-ivanti-epmm-exploited-patch
https://www.cycognito.com/blog/emerging-threat-cve-2026-6973-authenticated-admin-rce-in-ivanti-endpoint-manager-mobile/
https://ctipilot.ch/entities/CVE-2026-6973/
https://www.tenable.com/cve/CVE-2026-6973
https://www.rapid7.com/db/vulnerabilities/ivantiepmm-cve-2026-6973/
https://zeropath.com/blog/cve-2026-5787-ivanti-epmm-certificate-validation
https://ctipilot.ch/briefs/2026-05-08/cve-2026-5787-cve-2026-6973-ivanti-epmm-pre-auth-certificate-impersonation-admin/
https://github.security.telekom.com/2026/03/ivanti-CVE-2026-1281-exploitation.html
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-6973-CVE-2026-10727?language=en_US
https://www.ivanti.com/blog/may-2026-epmm-security-update
https://kudelskisecurity.com/research/ivanti-epmm-cve-2026-6973-allows-rce-with-admin-credentials-under-active-exploitation
https://zeropath.com/blog/cve-2026-6973-ivanti-epmm-authenticated-rce
https://ctipilot.ch/briefs/2026-05-08/cve-2026-6973-ivanti-epmm-admin-api-improper-input-validation-rce-cvss-7-2-cisa/
https://pragma-core.com/blog/cve-2026-6973-ivanti-epmm-rce-actively-exploited-in-the-wild-and-already-in-cisa-kev
https://ccb.belgium.be/advisories/warning-authenticated-remote-code-execution-vulnerability-ivanti-epmm-exploited-patch
https://www.cycognito.com/blog/emerging-threat-cve-2026-6973-authenticated-admin-rce-in-ivanti-endpoint-manager-mobile/
https://ctipilot.ch/entities/CVE-2026-6973/
https://www.tenable.com/cve/CVE-2026-6973
https://www.rapid7.com/db/vulnerabilities/ivantiepmm-cve-2026-6973/
https://zeropath.com/blog/cve-2026-5787-ivanti-epmm-certificate-validation
https://ctipilot.ch/briefs/2026-05-08/cve-2026-5787-cve-2026-6973-ivanti-epmm-pre-auth-certificate-impersonation-admin/
https://github.security.telekom.com/2026/03/ivanti-CVE-2026-1281-exploitation.html
Hunting hypothesis agent
Monitor for anomalous API calls to Ivanti EPMM admin interfaces with crafted input bypassing validation, indicating exploitation of the input validation flaw leading to remote code execution.
Research details
ComponentEPMM administrative REST API (admin interface input validation handling for OS-level command execution)
PreconditionsValid administrative credentials for the EPMM admin interface — may be obtained via: (1) prior exploitation of CVE-2026-1340 (Jan 2026, unauthenticated RCE allowing credential harvesting from EPMM database); (2) chaining with CVE-2026-5787 (improper certificate validation allowing unauthenticated Sentry host impersonation to obtain CA-signed client certificates); Network reachability to EPMM admin REST API endpoints running a vulnerable version (before 12.6.1.1, 12.7.0.1, or 12.8.0.1); EPMM process runs with elevated privileges enabling full system compromise agent
DeliveryHTTP POST/GET request to EPMM administrative REST API endpoint with crafted input that bypasses input validation and triggers OS-level command execution
Public PoCno
Exploit notesCVSS attack complexity: LOW. Requires valid admin credentials (not remotely exploitable without them — however, chaining with CVE-2026-5787 makes this effectively pre-auth). EPMM is a closed-source appliance; the specific vulnerable code path has not been publicly disclosed. Credential harvesting via CVE-2026-1340 was observed in active campaigns since Jan 2026. CVE-2026-5787 (disclosed same day May 2026) provides direct pre-auth chain: unauthenticated attacker impersonates Sentry host → gets CA-signed certificates → authenticates to admin API → exploits CVE-2026-6973. No public exploit code available. Ivanti confirms very limited targeted exploitation in the wild. An estimated 508 internet-exposed EPMM on-prem instances in EU (Censys/Shodan).
SummaryCVE-2026-6973 is an improper input validation vulnerability (CWE-20, CVSS 7.2) in Ivanti EPMM affecting versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1. It allows an authenticated admin user to pass crafted input to an EPMM REST API endpoint, triggering OS-level code execution at the service account privilege level. Actively exploited in the wild (CISA KEV, added 2026-05-07), typically chained with CVE-2026-5787 (Sentry certificate validation bypass, CVSS 9.1) which makes the exploit effectively unauthenticated, or via credential reuse from prior CVE-2026-1340 campaigns. No public PoC code is available; exploitation remains highly targeted and limited in scope.
Tia coverage
First reported2026-06-10
First exploit report2026-05-08
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
ivanti-sentry-max-severity-rce-auth-bypass-cve-2026-10520-cvss-1
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.