Loading story…
Ivanti released security updates for Endpoint Manager Mobile (EPMM) to fix two high-severity vulnerabilities, CVE-2026-6973 and CVE-2026-10727, that could let an authenticated remote attacker achieve remote code execution and privilege escalation. Ivanti said CVE-2026-6973 is a configuration control weakness that allows arbitrary Apache directive injection, while CVE-2026-10727 is an OS command injection flaw that can result in command execution as root. The company said it was not aware of customer exploitation at the time of disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On June 9, 2026, the Canadian Centre for Cyber Security published alert AV26-567 highlighting Ivanti advisories for multiple products, including EPMM and Sentry. The notice urged administrators to review the advisories and apply the required updates.
On 2026-06-09, Ivanti disclosed four vulnerabilities affecting Endpoint Manager Mobile and Ivanti Sentry, including Sentry flaws CVE-2026-10520 and CVE-2026-10523 that could enable administrative takeover and root-level remote code execution. Ivanti released patches for affected versions and said it had not observed exploitation in the wild at disclosure.
On June 9, 2026, Ivanti published a security advisory for Endpoint Manager Mobile addressing CVE-2026-6973 and CVE-2026-10727. The company said the issues were fixed in EPMM versions 12.9.0.1, 12.8.0.3, and 12.7.0.2, and noted it was not aware of customer exploitation at disclosure.
On 2026-05-07, Ivanti disclosed CVE-2026-6973, an actively exploited improper input validation flaw in on-premises Endpoint Manager Mobile that can lead to remote code execution by an authenticated administrator. Ivanti and the Belgian Centre for Cyber Security said a limited number of customers were compromised, and Ivanti released patched EPMM builds while advising organizations to rotate administrative credentials if they may have been stolen.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcelabs.beazley.security
Open sourcecyber.gc.ca
Open sourcehub.ivanti.com
Open sourcezeropath.com
Open sourceforums.ivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti disclosed five vulnerabilities in **Endpoint Manager Mobile (EPMM)**, including **`CVE-2026-6973`**, an authenticated remote code execution flaw with a **CVSS 7.2** score that the company said has been exploited against a very limited number of customers. The issue requires administrative authentication, and Ivanti said organizations that rotated credentials after the earlier January flaws **`CVE-2026-1281`** and **`CVE-2026-1340`** have significantly reduced risk. CERT-SE separately highlighted that **`CVE-2026-6973`** was added to **CISA’s Known Exploited Vulnerabilities** catalog. The advisory also covers **`CVE-2026-5786`**, **`CVE-2026-5787`**, **`CVE-2026-5788`**, and **`CVE-2026-7821`**, with Ivanti reporting no known exploitation for those issues at disclosure time. According to the vendor and CERT-SE, the additional flaws include weaknesses that can enable administrative privilege gain and unauthenticated certificate access, while **`CVE-2026-7821`** affects only environments using **Apple Device Enrollment**. Ivanti urged customers to rotate administrative credentials and upgrade EPMM to **12.6.1.1**, **12.7.0.1**, or **12.8.0.1**; it also released compatible **Sentry** versions, while stating that Sentry itself is not affected.
Jul 24, 2026
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, `CVE-2023-35078` and `CVE-2023-35081`, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. `CVE-2023-35078` is a critical authentication bypass affecting internet-facing API paths, while `CVE-2023-35081` is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment. Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted `CVE-2023-35078` as a critical API access flaw, while Ivanti later disclosed `CVE-2023-35082`, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious `mi.war` Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.
Jun 29, 2026
Ivanti disclosed two **critical, actively exploited** Ivanti Endpoint Manager Mobile (*EPMM*) vulnerabilities—**CVE-2026-1281** and **CVE-2026-1340**—described as unauthenticated code-injection issues enabling **remote code execution (RCE)** with a **CVSS 9.8** rating. Ivanti reported exploitation affecting a *very limited number* of customers at disclosure and warned that successful compromise of the EPMM appliance could expose sensitive data stored in the platform (e.g., admin/user details and managed-device metadata such as phone numbers, IPs, installed apps, and identifiers like IMEI/MAC), and potentially allow attackers to change device configurations via the API or web console, including authentication-related settings. Guidance from national cybersecurity authorities emphasized that EPMM’s role in mobile device management can make it a pivot point into internal environments, potentially enabling lateral movement if the appliance is compromised. Affected versions include EPMM **12.5.x, 12.6.x, and 12.7.x** (including **12.5.1.0** and **12.6.1.0** and earlier as specified), while Ivanti’s cloud offerings (e.g., *Ivanti Neurons for MDM*) and *Ivanti Endpoint Manager (EPM)* are not impacted. Ivanti provided interim mitigations/hotfixes (RPM-based) with the caveat that hotfixes may need reapplication after upgrades, and indicated a permanent fix is expected in **EPMM 12.8.0.0**; organizations were advised to patch immediately and review appliances for compromise indicators such as anomalous logs and unexpected admin/configuration changes.
Jun 29, 2026