Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

Source Domain: thehackernews.com

Security firm Ivanti has disclosed that a new high-severity vulnerability, CVE-2026-6973 (CVSS score: 7.2), affecting its Endpoint Manager Mobile (EPMM), is currently being exploited in limited attacks. This flaw is due to improper input validation and could allow a remote authenticated administrator to execute arbitrary code. Ivanti has confirmed that only a very limited number of customers have been exploited, but all successful attacks have required administrative authentication. As a preventative measure, those affected by previous vulnerabilities in January are advised that following credential rotation recommendations significantly reduces the risk. Furthermore, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed this vulnerability in its Known Exploited Vulnerabilities catalog, compelling Federal Civilian Executive Branch (FCEB) agencies to implement the fix by May 10, 2026. Additionally, Ivanti has patched other vulnerabilities alongside CVE-2026-6973 that affect improper access control and certificate validation across its EPMM product.

Key Points:
– CVE-2026-6973 is a high-severity vulnerability in Ivanti Endpoint Manager Mobile allowing remote code execution by authenticated users.
– Federal agencies have ten days to apply the fix as mandated by CISA.
– Limited exploitation has occurred, but the perpetrators and attack goals remain unknown.
– Ivanti has patched four additional vulnerabilities across EPMM concerning improper access control and certificate validation.
– This issue only impacts on-premise EPMM and not any other Ivanti products.