{"id":"CVE-2026-6973","kind":"vulnerability","aliases":["CVE-2026-6973"],"related":[],"title":"ivanti endpoint manager mobile: An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely…","description":"Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Ivanti Endpoint Manager Mobile (EPMM) has an improper input validation flaw that lets a remote user who already has administrator access run code on the server. Attackers are exploiting it in the wild according to CISA's Known Exploited Vulnerabilities catalog.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2026-05-07T00:00:00+00:00","products":[{"name":"Ivanti Endpoint Manager Mobile (EPMM)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti endpoint manager mobile","fixed":["12.6.1.1"],"affected":"< 12.6.1.1","ecosystem":"vendor"},{"name":"ivanti endpoint manager mobile","fixed":[],"affected":"= 12.7.0.0","ecosystem":"vendor"},{"name":"ivanti endpoint manager mobile","fixed":[],"affected":"= 12.8.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["endpoint-manager-mobile","exploited","ivanti","on-prem-mdm","vendor"],"not_affected_if":["no-epmm-deployment"],"how_to_check":null,"fix":"Apply the mitigations from Ivanti's vendor advisory; the sources do not name a fixed version. If no mitigation is available, CISA says to discontinue use of the product.","status":"open","published_at":"2026-05-07T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:35:41+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:35:41Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from Ivanti's vendor advisory; the sources do not name a fixed version. If no mitigation is available, CISA says to discontinue use of the product.","summary":"Ivanti Endpoint Manager Mobile (EPMM) has an improper input validation flaw that lets a remote user who already has administrator access run code on the server. Attackers are exploiting it in the wild according to CISA's Known Exploited Vulnerabilities catalog.","category":"vendor","who_cares":["ivanti","endpoint-manager-mobile","on-prem-mdm"],"confidence":0.6,"analyst_note":"Find Ivanti's advisory for CVE-2026-6973 to get affected and fixed versions, a patch or mitigation, and any IOCs or log checks for exploitation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-epmm-deployment"],"severity_if_unknown":"high"},"cost_usd":0.000377,"input_tokens":2116,"output_tokens":331,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':133C '-2026':22A,25A '-6973':23A,26A '12.6.1.1':14A '12.7.0.1':15A '12.8.0.1':17A '22':132C 'access':75B,115C 'accord':88B 'achiev':117C 'action':123C 'administr':74B,114C 'allow':18A,108C 'alreadi':72B 'appli':124C 'applic':130C 'attack':81B 'authent':111C 'bod':131C 'catalog':95B 'cisa':90B,121C 'cloud':136C 'code':77B,119C 'contain':101C 'cve':21A,24A 'discontinu':139C 'endpoint':2A,28A,33A,37A,41A,45B,56B,97C 'endpoint-manager-mobil':44B 'epmm':11A,31A,59B,100C 'execut':120C 'exploit':48B,83B,93B 'flaw':65B 'follow':129C 'guidanc':134C 'improp':6A,62B,103C 'input':7A,63B,104C 'instruct':128C 'ivanti':1A,10A,27A,32A,36A,40A,49B,55B,96C 'known':92B 'let':67B 'manag':3A,46B,57B,98C 'manager':29A,34A,38A,42A 'mdm':53B 'mitig':125C,145C 'mobil':4A,47B,58B,99C 'mobile':30A,35A,39A,43A 'on-prem-mdm':50B 'per':126C 'prem':52B 'product':143C 'remot':20A,69B,110C,118C 'requir':122C 'run':76B 'server':80B 'servic':137C 'unavail':147C 'use':140C 'user':70B,112C 'valid':8A,64B,105C 'vendor':54B,127C 'version':13A 'vulner':94B,106C 'wild':87B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-07T00:00:00+00:00","kev":{"dateAdded":"2026-05-07","dueDate":"2026-05-10","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-6973","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-6973","severity":null,"published_at":"2026-05-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-6973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6973","severity":null,"published_at":"2026-05-07T16:16:23+00:00","modified_at":"2026-06-17T11:01:34+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}