Loading vulnerability…
Remote Code Execution in Ivanti Endpoint Manager Mobile
CVE-2026-6973 is an improper input validation vulnerability in on-premises Ivanti Endpoint Manager Mobile (EPMM). A remotely authenticated user holding administrative privileges can exploit the flaw to execute attacker-controlled code on the EPMM appliance. EPMM versions earlier than 12.6.1.1, 12.7.0.1, and 12.8.0.1 are affected. The vulnerability was reported as actively exploited against a limited number of customers.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation provides remote code execution with the privileges available to the EPMM administrative context. An attacker can compromise the EPMM appliance, establish persistence, access or modify managed-device enrollment and policy data, exfiltrate sensitive information, and potentially pivot to managed mobile endpoints or connected enterprise resources. Active exploitation was associated with use of administrative credentials compromised in earlier EPMM incidents.
If you can’t patch tonight, do this now.
Restrict remote access to EPMM administrative interfaces to trusted administrative networks and enforce strong authentication controls for privileged accounts. Review all accounts with EPMM administrative permissions, remove unauthorized or unnecessary access, and rotate privileged credentials. Monitor administrative activity and appliance configuration changes for anomalous behavior. Patching is required; credential rotation is necessary to disrupt exploitation using previously stolen administrator credentials.
Patch, then assume compromise.
Upgrade on-premises EPMM to the applicable fixed release: 12.6.1.1, 12.7.0.1, or 12.8.0.1 or later. The fixed releases also incorporate remediation for earlier EPMM vulnerabilities addressed through a separate temporary update. Rotate EPMM administrative credentials after patching, particularly where prior compromise is suspected or credentials were not rotated following earlier EPMM incidents.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
139 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.