Ivanti EPMM Flaws Include Exploited Admin-to-RCE Vulnerability
Active Exploitation · 2 sources · Updated 3mo ago · First seen May 8, 2026
Ivanti disclosed five vulnerabilities in Endpoint Manager Mobile (EPMM), including CVE-2026-6973, an authenticated remote code execution flaw with a CVSS 7.2 score that the company said has been exploited against a very limited number of customers. The issue requires administrative authentication, and Ivanti said organizations that rotated credentials after the earlier January flaws CVE-2026-1281 and CVE-2026-1340 have significantly reduced risk. CERT-SE separately highlighted that CVE-2026-6973 was added to CISA’s Known Exploited Vulnerabilities catalog.
The advisory also covers CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821, with Ivanti reporting no known exploitation for those issues at disclosure time. According to the vendor and CERT-SE, the additional flaws include weaknesses that can enable administrative privilege gain and unauthenticated certificate access, while CVE-2026-7821 affects only environments using Apple Device Enrollment. Ivanti urged customers to rotate administrative credentials and upgrade EPMM to 12.6.1.1, 12.7.0.1, or 12.8.0.1; it also released compatible Sentry versions, while stating that Sentry itself is not affected.
