ADVISORY SUMMARY
A high-severity improper input validation zero-day in Ivanti Endpoint Manager Mobile (EPMM) on-premises allows a remotely authenticated user with administrative access to achieve remote code execution on the EPMM appliance. Attackers have chained this with credentials stolen via January 2026 EPMM zero-days (CVE-2026-1281, CVE-2026-1340) to establish a multi-stage attack chain — initial unauthenticated compromise followed by credential reuse for RCE. CISA added CVE-2026-6973 to KEV on May 7 with a 3-day federal remediation deadline of May 10, 2026. Shadowserver tracked over 800 internet-exposed EPMM instances at time of disclosure.
AFFECTED SYSTEMS
MITIGATION GUIDANCE
1) Upgrade EPMM immediately to version 12.6.1.1, 12.7.0.1, or 12.8.0.1. 2) Rotate ALL EPMM administrative credentials — especially critical if your environment was impacted by the January 2026 CVE-2026-1281/CVE-2026-1340 zero-days. 3) Review all accounts with administrative rights for unexpected additions or privilege changes. 4) Invalidate active sessions and review authentication logs for unusual admin login patterns. 5) Review Ivanti Sentry appliance security in parallel due to its dependency on EPMM configuration. Ivanti Neurons for MDM (cloud), Ivanti EPM, and Ivanti Sentry are NOT affected by CVE-2026-6973.
DETECTION SIGNATURES
No reliable atomic IOCs for CVE-2026-6973 have been published. Monitor EPMM for: unexpected EPMM configuration changes; newly created or modified admin accounts; unusual device management actions (mass policy pushes, remote wipes); anomalous entries in /var/log/httpd/https-access_log. Treat any anomalies during the unpatched window as requiring forensic review. Prior EPMM zero-days have been exploited by China- and Iran-linked threat actors — apply threat-model-appropriate logging and monitoring.
REFERENCES
- → https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs
- → https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- → https://nvd.nist.gov/vuln/detail/CVE-2026-6973
- → https://www.helpnetsecurity.com/2026/05/08/ivanti-epmm-zero-day-cve-2026-6973/