[KEV] CVE-2026-6973 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-6973 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-6973 is an improper input validation vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows a remotely authenticated administrative user to achieve remote code execution on the affected system.

Technical Detail

The flaw resides in Ivanti EPMM's input handling logic, where insufficient validation of attacker-controlled input can be leveraged by an authenticated user holding administrative privileges to execute arbitrary code remotely. While the specific injection vector has not been publicly detailed, improper input validation vulnerabilities of this class typically involve crafted requests that bypass sanitization controls and reach a code execution sink. Successful exploitation grants the attacker the ability to run arbitrary commands in the context of the application, potentially leading to full system compromise of the EPMM server.

Exploitation Status

CISA has confirmed active exploitation in the wild, adding this vulnerability to the Known Exploited Vulnerabilities catalog on May 7, 2026. The exploit maturity is rated Operational, meaning a functional exploit capable of reliable exploitation exists and is being used in real-world attacks, not merely as a proof of concept. Organizations running Ivanti EPMM should treat this as an actively targeted vulnerability requiring immediate action.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. Given that Ivanti EPMM is a mobile device management platform commonly deployed in enterprise and government environments, it represents a high-value target for threat actors seeking persistent access to managed endpoint infrastructure. Attribution data may emerge as incident investigations progress.

What To Do

Apply the vendor-supplied patch for Ivanti EPMM immediately. Per CISA's Known Exploited Vulnerabilities catalog, federal civilian executive branch agencies are required to remediate this vulnerability or apply documented mitigations by the deadline established under Binding Operational Directive 22-01. All organizations should treat this as a critical priority patch regardless of federal mandate. In the interim, restrict administrative access to the EPMM management interface to trusted IP ranges only, enforce multi-factor authentication on all administrative accounts, and review EPMM administrative access logs for anomalous activity or unexpected command execution. Monitor vendor advisories from Ivanti for specific patch version guidance and any additional indicators of compromise.