{"id":"ivanti-epmm-admin-code-execution-may-2026","category":"patch","status":"closed","title":"Ivanti EPMM administrator code-execution flaw CVE-2026-6973 used in attacks","tldr":"Attackers with an Ivanti EPMM administrator login used CVE-2026-6973 to run code on workplace mobile-management servers. May fixes are available; ask IT to check the subsequent June advisory and apply current vendor updates.","summary":"Ivanti disclosed CVE-2026-6973 on 7 May after observing very limited exploitation. The input-validation flaw lets someone already signed in as an administrator run their own code on an on-premises Endpoint Manager Mobile server. It affects workplace mobile-management infrastructure; Ivanti says Neurons for MDM, the separate Endpoint Manager product and Sentry are unaffected by this May issue. Ivanti's CVE information identifies 12.6.1.1, 12.7.0.1 and 12.8.0.1 as fixed releases. CISA listed the flaw as exploited the same day. A June EPMM advisory again names this CVE and covers newer releases, but its relationship to the May fix could not be verified: the detailed vendor advisory was inaccessible. The documented May fix remains the basis for the patched status here. The reviewed sources do not establish that attacks have ended or identify affected customers.","action":"If work manages your phone or tablet through Ivanti EPMM, ask IT to confirm it has applied current Ivanti updates, checked the June advisory and reviewed administrator accounts and credentials. This is a server update for IT to handle, rather than an update you install on your phone.","product":"Ivanti Endpoint Manager Mobile (EPMM), on-premises","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-6973"],"tags":["ivanti","epmm","mobile-device-management","remote-code-execution","actively-exploited"],"affected":["Ivanti EPMM versions before 12.6.1.1, 12.7.0.1 and 12.8.0.1, as described in Ivanti's May CVE information"],"fixed":["12.6.1.1","12.7.0.1","12.8.0.1"],"matches":[],"sources":[{"kind":"advisory","title":"May 2026 EPMM Security Update","url":"https://www.ivanti.com/blog/may-2026-epmm-security-update","by":"Ivanti","date":"2026-05-07"},{"kind":"advisory","title":"CVE-2026-6973 Detail — including Ivanti CNA information","url":"https://nvd.nist.gov/vuln/detail/cve-2026-6973","by":"NIST","date":"2026-05-07"},{"kind":"advisory","title":"Ivanti security advisory (AV26-435)","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-435","by":"Canadian Centre for Cyber Security","date":"2026-05-07"},{"kind":"news","title":"CISA gives feds three days to patch Ivanti flaw exploited as zero-day","url":"https://www.bleepingcomputer.com/news/security/cisa-gives-feds-three-days-to-patch-ivanti-flaw-exploited-as-zero-day/","by":"BleepingComputer","date":"2026-05-08"},{"kind":"advisory","title":"Ivanti security advisory (AV26-567) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-567","by":"Canadian Centre for Cyber Security","date":"2026-06-11"}],"started":"2026-05-07","closed":"2026-06-09","created":"2026-11-03T22:21:35.181Z","updated":"2026-11-03T22:21:35.181Z","cve_notes":[{"cve":"CVE-2026-6973","name":"Administrator code execution in Ivanti EPMM","what":"An input-validation flaw in Ivanti's on-premises EPMM server lets a remote attacker with an authenticated administrator account run their own code.","severity":"high","cvss":7.2}],"timeline":[{"at":"2026-06-09","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"A further EPMM advisory again named CVE-2026-6973 alongside another flaw. Canada's bulletin lists newer affected releases, but does not explain whether this changes the May fix guidance for CVE-2026-6973.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-567","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-05-07","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-6973 to its Known Exploited Vulnerabilities catalogue. US federal agencies were required to act by 10 May.","url":"https://www.bleepingcomputer.com/news/security/cisa-gives-feds-three-days-to-patch-ivanti-flaw-exploited-as-zero-day/","by":"BleepingComputer","patch":null},{"at":"2026-05-07","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Ivanti released EPMM 12.6.1.1, 12.7.0.1 and 12.8.0.1 to address the flaw.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-435","by":"Canadian Centre for Cyber Security","patch":"patched"},{"at":"2026-05-07","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Ivanti disclosed CVE-2026-6973 and confirmed very limited exploitation. Attackers need an authenticated EPMM administrator account; only the on-premises product is affected.","url":"https://www.ivanti.com/blog/may-2026-epmm-security-update","by":"Ivanti","patch":null}],"url":"https://hard.fyi/live/ivanti-epmm-admin-code-execution-may-2026/","json":"https://hard.fyi/api/live?id=ivanti-epmm-admin-code-execution-may-2026"}