Ivanti Patches CVE-2026-6973 Zero-Day in EPMM as CISA Adds Authenticated Admin RCE Bug to KEV
Ivanti disclosed an actively exploited authenticated RCE in Endpoint Manager Mobile alongside four other high-severity flaws. CISA added it to KEV on May 7 with a May 10 federal patch deadline.
Overview
Ivanti has disclosed an actively exploited zero-day in its on-premises Endpoint Manager Mobile (EPMM) product, tracked as CVE-2026-6973, alongside four other high-severity flaws addressed in the same May advisory. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog on May 7, 2026, giving Federal Civilian Executive Branch agencies a May 10 deadline to apply the fix, according to NIST’s NVD entry.
What We Know
CVE-2026-6973 is an improper input validation flaw in Ivanti EPMM that carries a CVSS base score of 7.2 (high). NVD describes it as a vulnerability that “allows a remotely authenticated user with administrative access to achieve remote code execution,” affecting versions before 12.6.1.1, 12.7.0.1, and 12.8.0.1, per the NVD record. The same fixed versions resolve the issue.
Ivanti said in its advisory that “At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation,” as quoted by BleepingComputer. The advisory was published Thursday, May 8, 2026, according to Help Net Security.
The issues only affect the on-premises EPMM product. Ivanti stated the flaws “are not present in Ivanti Neurons for MDM, Ivanti’s cloud-based unified endpoint management solution,” as reported by BleepingComputer.
Four additional high-severity bugs were patched the same day. According to heise online, CVE-2026-5786 is an access-control flaw that lets authenticated network attackers gain admin access, with NVD scoring it 8.8, confirmed in the NVD record. CVE-2026-5787 covers insufficient certificate validation that lets unauthenticated network attackers impersonate registered Sentry hosts; CVE-2026-5788 is an access-control bug allowing arbitrary method invocation without authentication; and CVE-2026-7821 is a certificate-validation flaw that lets unauthenticated attackers enroll devices, also per heise. Ivanti said it has no evidence of in-the-wild exploitation for those four, The Hacker News reported.
Detection support is thin. Ivanti’s advisory acknowledges that “there are currently no reliable atomic indicators of compromise that could be used to detect compromise via CVE-2026-6973,” as quoted by Help Net Security.
Exposure data illustrates the scope. The Shadowserver Foundation tracks more than 850 EPMM instances reachable on the public internet, with 508 in Europe and 182 in North America, BleepingComputer reported.
Context: The January Zero-Days
The May patch lands months after a separate pair of EPMM zero-days. Ivanti has told customers that organizations that rotated credentials following its January 2026 guidance for CVE-2026-1281 and CVE-2026-1340 face significantly reduced exploitation risk from the new flaw, The Hacker News reported. Those earlier vulnerabilities, exploited starting in late January, affected nearly 100 victims including the Dutch Data Protection Authority and were remotely exploitable without authentication, according to CyberScoop.
SecurityWeek noted that the new bug is likely to be chained with CVE-2026-1281 or CVE-2026-1340 in attacks aimed at full mobile device management infrastructure compromise, and that Chinese threat actors are often believed to be behind zero-day attacks targeting Ivanti products.
What We Don’t Know
Ivanti has not disclosed when exploitation of CVE-2026-6973 first began, nor precisely how many customers have been impacted. “Ivanti did not say when the first instance of exploitation occurred, or precisely how many customers have already been impacted,” CyberScoop reported. No threat actor attribution has been confirmed for the new bug, and no reliable indicators of compromise are available.
Why It Matters
EPMM is mobile device management software that brokers configuration, certificates and policy for fleets of corporate phones and tablets. A remote-code-execution foothold on the EPMM server places attackers inside the trust boundary that signs and pushes profiles to managed devices, which is why the January CVE-2026-1281/1340 campaign reached government agencies in multiple countries. The May patch closes a high-severity flaw that requires admin credentials to reach, but the federal seven-day clock from CISA underscores how quickly authenticated post-exploitation paths are weaponized once disclosed.