Brief Summary: CVE-2026-6973 in Ivanti EPMM — Authenticated RCE via Input Validation Flaw Exploited Through Credential Reuse

Introduction

Threat actors are chaining credential theft from a January 2026 Ivanti vulnerability with a newly disclosed input validation flaw to achieve remote code execution on Ivanti Endpoint Manager Mobile appliances. On May 7, 2026, both Ivanti and the Belgian Centre for Cyber Security confirmed that a limited number of customers had already been compromised through this attack chain. CVE-2026-6973 was therefore a zero day under active exploitation at the time of disclosure.

Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, is an on-premises mobile device management platform that enterprises and government agencies use to manage and secure mobile endpoints. Ivanti acquired MobileIron in December 2020 for approximately 872 million dollars, and EPMM remains a widely deployed MDM product, particularly in regulated industries and federal environments. It sits at the network edge and manages device enrollment and policy enforcement, which makes it a high-value target for adversaries seeking persistent access to enterprise environments.

Technical Information

CVE-2026-6973 is an Improper Input Validation weakness (CWE-20) in the on-premises Ivanti EPMM product. It carries a CVSS score of 7.2 and allows a remotely authenticated user with administrative privileges to achieve remote code execution on the underlying EPMM appliance.

Root Cause

The flaw is in how the EPMM appliance processes certain input from authenticated administrative sessions. Because EPMM is a closed-source, appliance-based product, the specific vulnerable code path has not been publicly disclosed. What we know from the advisory is that the input validation logic fails to properly sanitize or constrain input from an authenticated administrator, so that input can be interpreted in a way that results in arbitrary code execution on the host operating system.

Attack Flow

The observed exploitation of CVE-2026-6973 follows a multi-stage attack chain that spans two separate vulnerabilities and potentially months of elapsed time:

1. Threat actors first exploited CVE-2026-1340, a separate vulnerability disclosed in January 2026, to obtain valid administrative credentials from target EPMM appliances. Ivanti has stated with high confidence that the credentials used in the May exploitation campaign were harvested during these earlier compromises.

2. The attacker uses the stolen administrative credentials to authenticate to the target EPMM appliance remotely. This is the prerequisite for exploiting CVE-2026-6973. Without valid admin credentials, the vulnerable code path is not reachable.

3. Once authenticated with administrative privileges, the attacker provides crafted input that bypasses the insufficient validation logic. That input is processed in a context that allows arbitrary code execution on the underlying system.

4. Successful exploitation gives the attacker code execution on the EPMM appliance, which could lead to data exfiltration, lateral movement, or persistent access to the managed device fleet. Because EPMM manages mobile device enrollment and policy, a compromised appliance puts the confidentiality, integrity, and availability of every managed endpoint at risk.

The whole chain depends on credentials stolen earlier. Organizations that followed Ivanti's January 2026 guidance to rotate administrative credentials after the CVE-2026-1340 disclosure would have significantly reduced their exposure to this attack chain, even before the May patch was available.

Scope Limitations

The vulnerability affects only the on-premises EPMM product. These products are confirmed not affected:

• Ivanti Neurons for MDM (cloud-based)
• Ivanti EPM (Endpoint Manager, a separate product)
• Ivanti Sentry
• Other Ivanti products

Patch Information

Ivanti released patched firmware on May 7, 2026 as part of a broader May 2026 Security Advisory that addressed five high-severity vulnerabilities in EPMM, including CVE-2026-6973. Because EPMM is a closed-source, appliance-based product, the fix ships as a full version update rather than a source code commit or diff. There is no public code-level patch to inspect.

The fix is included in three new maintenance releases, one for each of the three supported EPMM release trains:

Ivanti provides two delivery mechanisms for each fixed version, and both require authenticated access to the Ivanti support portal:

• Full ISO: for deploying a brand-new EPMM appliance (e.g., mobileiron-12.8.0.1-217.iso).
• In-place update package: for upgrading an existing EPMM appliance without rebuilding it.

The same patched versions also include the fixes for CVE-2026-1281 and CVE-2026-1340, which were disclosed in January 2026 and previously required a separate RPM hotfix. The fix is cumulative, so organizations that apply the May update no longer need to maintain the January RPM package. This matters here because Ivanti has stated with high confidence that the admin credentials used to exploit CVE-2026-6973 in the wild were originally stolen through the earlier CVE-2026-1340 exploitation. The patch therefore closes the immediate code-level input validation gap, while the bundled January fixes close the credential theft vector that made exploitation practical.

The patch applies to the on-premises EPMM product only. Ivanti Neurons for MDM (the cloud-based equivalent), Ivanti Sentry, and Ivanti EPM are not affected and do not need updates for this CVE. Ivanti did release new Sentry versions at the same time (10.4.2, 10.5.1, and 10.6.1). Sentry itself is not vulnerable, but customers deploying a new Sentry instance after upgrading EPMM will need one of these newer Sentry builds because of inter-component compatibility requirements.

Beyond patching, organizations must also rotate all administrative credentials on their EPMM appliances. The credential reuse attack chain is confirmed, and patching alone is not enough if the attacker already holds valid admin credentials.

Affected Systems and Versions

The vulnerability applies to every on-premises EPMM deployment running version 12.8.0.0 or earlier, regardless of configuration. Cloud customers using Ivanti Neurons for MDM need to take no action for this flaw.

Vendor Security History

Ivanti's EPMM product line has been under sustained security pressure throughout 2026. In January 2026, Ivanti disclosed CVE-2026-1281 and CVE-2026-1340. Both were exploited as zero days and required emergency patching via an RPM hotfix. The exploitation of CVE-2026-1340 is directly linked to the current CVE-2026-6973 campaign, because credentials stolen in those January compromises are being reused to authenticate and trigger the new input validation flaw.

In April 2026, CISA ordered federal agencies to patch exploited Ivanti EPMM flaws on an accelerated timeline.

The May 2026 advisory that includes CVE-2026-6973 also addresses four other newly discovered vulnerabilities: CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821. Only CVE-2026-6973 is confirmed exploited from this new batch. CVE-2026-7821 still deserves attention, because it does not require authentication and specifically affects customers using Apple Device Enrollment.

Recurring critical vulnerabilities in an edge-facing appliance, along with confirmed in-the-wild exploitation, mean any organization running Ivanti EPMM should monitor it closely and patch it on an accelerated cycle.

References

• NVD Entry for CVE-2026-6973
• Ivanti May 2026 Security Advisory (Hub)
• Ivanti May 2026 Security Advisory (Forums)
• Ivanti Blog: May 2026 EPMM Security Update
• Belgian Centre for Cyber Security Advisory
• BleepingComputer: Ivanti warns of new EPMM flaw exploited in zero day attacks
• BleepingComputer: CISA orders feds to patch exploited Ivanti EPMM flaw
• Ivanti Wikipedia Entry