Ivanti and ConnectWise Patch Actively Exploited and Critical Enterprise Management Flaws

Ivanti released fixes for a newly disclosed high-severity flaw in its on-premises Endpoint Manager Mobile (EPMM) platform, tracked as CVE-2026-6973, after confirming limited zero-day exploitation. The vulnerability is caused by improper input validation and can lead to arbitrary code execution when a remote attacker already has administrator-level access. Ivanti said the issue affects EPMM 12.8.0.0 and earlier and issued patched versions 12.6.1.1, 12.7.0.1, and 12.8.0.1, while urging customers to review privileged accounts and rotate credentials. The disclosure adds to a longer pattern of Ivanti security incidents: CISA previously warned that CVE-2023-35082, a critical authentication bypass flaw in Ivanti EPMM and MobileIron Core, was being actively exploited to gain unauthenticated API access, expose user data, and potentially backdoor servers when chained with other vulnerabilities.

ConnectWise also disclosed a critical vulnerability in ConnectWise Automate, tracked as CVE-2026-9089, affecting versions prior to 2026.5. The flaw, classified as CWE-494, stems from insufficient integrity verification during plugin loading and self-update operations and could allow malicious code execution on client machines during agent updates under specific network conditions. ConnectWise assigned the issue a CVSS score of 8.8, automatically updated cloud deployments, and instructed on-premises customers to manually upgrade to version 2026.5; Canada’s Cyber Centre separately urged administrators to apply the vendor update. The disclosures highlight continued risk across widely deployed enterprise management platforms, with internet exposure data showing hundreds of Ivanti EPMM systems and broad operational dependence on remote monitoring and mobile device management software.