Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

IVANTI EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access

Inspired by the growing threat landscape and the rapid evolution of cyber threats, Ivanti has issued a critical warning regarding a newly discovered security vulnerability in their Endpoint Manager Mobile (EPMM) software. The vulnerability, CVE-2026-6973, is categorized as high severity with a CVSS score of 7.2, highlighting its potential for remote code execution and access to admin-level privileges.

What is the Vulnerability?

The vulnerability lies in improper input validation within EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 of the software. This means that for administrators using older versions of EPMM, they may be at risk of exploitation from remote attackers who possess administrative access.

Impact on Administrators

This vulnerability allows attackers to remotely execute arbitrary code on the target system, thus granting them unauthorized access and control over the administrator's authority. The exploit essentially involves a flaw in how data is processed by EPMM before it is validated for input limits, making it susceptible to exploitation through unspecified channels.

How Ivanti Alerts About It

While the vulnerability has been known since December 2026 (CVE-2026-6973), Ivanti has recently become aware of a specific instance where attackers have actively exploited this flaw in limited attacks. This highlights the need for continuous security updates and patching, as failing to do so may leave administrators and other users vulnerable.

What Users Should Do

Given that Ivanti is aware of these incidents involving CVE-2026-6973 in limited attacks, it's imperative for users with admin access on EPMM to ensure they are running the latest version of the software. Regular updates can help prevent such vulnerabilities from being exploited and provide a safeguard against potential threats.

What Users Can Do

In light of this alert, Ivanti is urging users with administrative access on EPMM to ensure they are running the latest version of the software. Regular updates can help prevent such vulnerabilities from being exploited and provide a safeguard against potential threats.

Conclusion

The high-severity vulnerability in IVANTI's Endpoint Manager Mobile (EPMM) has been under active exploitation for some time, with limited attacks reported. This is yet another reminder of the ever-evolving nature of cyber threat landscapes and the importance of staying informed about new vulnerabilities and their potential impacts on users' systems.