Bleepingcomputer Ivanti EPMM Zero-Day Vulnerability Exploited in Active Attacks
Article Content
- •CVE-2026-6973 is a zero-day vulnerability in Ivanti EPMM, actively exploited since May 7, 2026.
- •The vulnerability allows remote code execution for authenticated users with admin privileges.
- •CISA has mandated federal agencies to patch affected systems by May 10, 2026.
Ivanti has disclosed a zero-day vulnerability (CVE-2026-6973) in its Endpoint Manager Mobile (EPMM) product, which has been actively exploited by attackers. This flaw allows authenticated users with administrative privileges to execute arbitrary code remotely on affected systems. Ivanti issued patches for this and four other high-severity vulnerabilities on May 7, 2026. The vulnerability affects EPMM versions 12.8.0.0 and earlier. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this CVE to its list of exploited vulnerabilities and mandated federal agencies to patch their systems by May 10, 2026. Ivanti previously disclosed two critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in January 2026, which have also been exploited. The current exploitation requires administrative access, limiting the immediate impact but still posing significant risks to organizations that have not followed prior security recommendations.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (27)
Following this threat?
Track Ivanti and CVE-2026-1281 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…