Ivanti EPMM administrator code-execution flaw CVE-2026-6973 used in attacks
Attackers with an Ivanti EPMM administrator login used CVE-2026-6973 to run code on workplace mobile-management servers. May fixes are available; ask IT to check the subsequent June advisory and apply current vendor updates.
If work manages your phone or tablet through Ivanti EPMM, ask IT to confirm it has applied current Ivanti updates, checked the June advisory and reviewed administrator accounts and credentials. This is a server update for IT to handle, rather than an update you install on your phone.
What’s happening
Ivanti disclosed CVE-2026-6973 on 7 May after observing very limited exploitation. The input-validation flaw lets someone already signed in as an administrator run their own code on an on-premises Endpoint Manager Mobile server. It affects workplace mobile-management infrastructure; Ivanti says Neurons for MDM, the separate Endpoint Manager product and Sentry are unaffected by this May issue. Ivanti's CVE information identifies 12.6.1.1, 12.7.0.1 and 12.8.0.1 as fixed releases. CISA listed the flaw as exploited the same day. A June EPMM advisory again names this CVE and covers newer releases, but its relationship to the May fix could not be verified: the detailed vendor advisory was inaccessible. The documented May fix remains the basis for the patched status here. The reviewed sources do not establish that attacks have ended or identify affected customers.
- What
- Flaw
- Affects
- Ivanti Endpoint Manager Mobile (EPMM), on-premises
- Affected
- Ivanti EPMM versions before 12.6.1.1, 12.7.0.1 and 12.8.0.1, as described in Ivanti's May CVE information
- Fixed in
- 12.6.1.1
12.7.0.1
12.8.0.1 - Since
- 7 May 2026
- Closed
- 9 June 2026
Timeline
- Update
A further EPMM advisory again named CVE-2026-6973 alongside another flaw. Canada's bulletin lists newer affected releases, but does not explain whether this changes the May fix guidance for CVE-2026-6973.
- CISA added
CISA added CVE-2026-6973 to its Known Exploited Vulnerabilities catalogue. US federal agencies were required to act by 10 May.
- New fixFixed
Ivanti released EPMM 12.6.1.1, 12.7.0.1 and 12.8.0.1 to address the flaw.
- Made public
Ivanti disclosed CVE-2026-6973 and confirmed very limited exploitation. Attackers need an authenticated EPMM administrator account; only the on-premises product is affected.
Sources
- May 2026 EPMM Security UpdateIvanti · 7 May 2026
- CVE-2026-6973 Detail — including Ivanti CNA informationNIST · 7 May 2026
- Ivanti security advisory (AV26-435)Canadian Centre for Cyber Security · 7 May 2026
- CISA gives feds three days to patch Ivanti flaw exploited as zero-dayBleepingComputer · 8 May 2026
- Ivanti security advisory (AV26-567) – Update 1Canadian Centre for Cyber Security · 11 June 2026