CC-4780 - Ivanti Releases Security Updates for High‑Severity Vulnerabilities in Endpoint Manager Mobile (EPMM)

Two high‑severity vulnerabilities in Ivanti EPMM could enable authenticated attackers to gain administrative access and execute arbitrary code

Two high‑severity vulnerabilities in Ivanti EPMM could enable authenticated attackers to gain administrative access and execute arbitrary code

The following platforms are known to be affected:

Ivanti Endpoint Manager Mobile

Exploitation of CVE-2026-6973 in the wild

Ivanti has confirmed limited active exploitation of CVE‑2026‑6973 in the wild. CVE-2026-6973 has been added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog.

The NHS England National CSOC assesses further exploitation as highly likely.

Ivanti has released security updates to address two high severity vulnerabilities in Endpoint Manager Mobile (EPMM). Successful exploitation could allow an authenticated attacker to gain full administrative control of affected EPMM environments, potentially leading to remote code execution and compromise of managed mobile devices.

Affected organisations are strongly encouraged to review Ivanti’s May 2026 Security Advisory – Ivanti Endpoint Manager Mobile (EPMM) Multiple CVEs and apply the relevant updates as soon as practicable.

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.

Last edited: 8 May 2026 3:58 pm