Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Authenticated RCE Zero-Day — CVE-2026-6973 (CISA KEV, Active Exploitation)

Ivanti Endpoint Manager Mobile (EPMM) Improper Input (TL-2026-0477), also tracked as Ivanti EPMM May 2026 Zero-Day, is a high-severity software vulnerability scored CVSS 7.2, first published 2026-05-07. It has no confirmed attribution, affects Ivanti Endpoint Manager Mobile (EPMM), references 1 CVE (CVE-2026-6973), maps to 27 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-0477

Threat ID
TL-2026-0477
Also known as
Ivanti EPMM May 2026 Zero-Day, Ivanti EPMM Authenticated RCE 2026
Severity
HIGH
CVSS
7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-05-07
Last reviewed
2026-05-07
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, defense industrial base, financial services, healthcare, telecommunications, education, critical infrastructure
Target regions
Europe, North America, Asia-Pacific
Detection rules
9
Indicators of compromise
17

Ivanti disclosed CVE-2026-6973, a CWE-20 Improper Input Validation flaw in on-prem Endpoint Manager Mobile (EPMM) 12.8.0.0 and earlier that lets a remotely authenticated administrator achieve arbitrary code execution on the appliance (CVSS 7.2 HIGH). Ivanti confirmed limited in-the-wild zero-day exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities Catalog on 2026-05-07 with a federal remediation deadline. The bug is one of five CVEs (CVE-2026-5786/5787/5788/7821 and CVE-2026-6973) shipped together in the May 2026 EPMM advisory; chaining the unauthenticated access-control bugs with CVE-2026-6973 yields a full pre-auth-to-RCE path on unpatched on-prem EPMM cores.

How Ivanti Endpoint Manager Mobile (EPMM) Improper Input works

CVE-2026-6973 is the actively exploited zero-day in Ivanti's May 2026 Endpoint Manager Mobile (EPMM) security advisory. The vulnerability is classified as CWE-20 Improper Input Validation, scored CVSS 3.1 7.2 HIGH (vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and lives in unspecified administrative endpoints of the EPMM core appliance. A remote attacker who already holds administrative access to the EPMM web console can submit crafted input that bypasses server-side validation and is interpreted by the underlying runtime, yielding arbitrary code execution as the EPMM service account on the appliance host. EPMM appliances run as the central trust anchor for enterprise mobile fleets — they hold MDM enrollment certificates, push notification keys, Active Directory bind credentials, certificate authority private keys, VPN profiles, Wi-Fi credentials, and policy payloads — so RCE on the core is a high-value pivot point into both the corporate network and tens of thousands of managed mobile endpoints.

Ivanti shipped CVE-2026-6973 alongside four other CVEs in the same May 2026 EPMM advisory: CVE-2026-5786 (CWE-284 Improper Access Control allowing an authenticated user to gain administrative access), CVE-2026-5787 (CWE-295 Improper Certificate Validation enabling impersonation of registered Sentry hosts and theft of valid CA-signed certificates), CVE-2026-5788 (CWE-284 Improper Access Control allowing an unauthenticated remote attacker to invoke arbitrary methods on the EPMM core), and CVE-2026-7821 (CWE-295 Improper Certificate Validation enabling enrollment of devices belonging to a restricted set of unenrolled users). The most plausible end-to-end exploit chain stitches CVE-2026-5788 (unauthenticated method invocation) with CVE-2026-5786 (privilege escalation to administrator) and finally CVE-2026-6973 (administrator-authenticated RCE), giving a fully unauthenticated remote code execution path against any internet-exposed unpatched EPMM core. Ivanti's explicit recommendation to rotate EPMM administrative credentials post-patch — beyond the standard "apply patch" guidance — strongly implies that observed in-the-wild operators are reusing or harvesting EPMM admin credentials, consistent with the credential-theft tradecraft seen in the January 2026 EPMM zero-days CVE-2026-1281 and CVE-2026-1340.

CISA added CVE-2026-6973 to the Known Exploited Vulnerabilities (KEV) Catalog on 2026-05-07, the same day Ivanti disclosed the advisory, triggering Binding Operational Directive 22-01 and a 21-day federal civilian remediation deadline. The Shadowserver Foundation tracks roughly 850+ internet-exposed Ivanti EPMM fingerprints globally — 508 in Europe, 182 in North America — most of which remain attributable to a small set of repeatedly targeted regulated sectors (government, defense industrial base, financial services, healthcare, telecom, education). Ivanti has not publicly attributed the activity. However, the EPMM product line has a sustained history of zero-day exploitation by the China-nexus UNC5221 cluster (Ivanti Connect Secure 2024, EPMM January 2026 CVE-2026-1281/1340), and the limited-scope, credential-harvesting tradecraft seen here is consistent with that actor cluster pending public attribution. Patches are available in EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1; cloud Ivanti Neurons for MDM, Ivanti EPM (desktop), and Ivanti Sentry are explicitly not affected.

Detection-relevant indicators include unexpected child processes spawned by EPMM service users (typically tomcat/jboss-style runtimes), abnormal outbound connections from EPMM cores to non-corporate infrastructure, modification of EPMM webapp directories outside scheduled patch windows, creation of new administrator accounts in the EPMM console, and Sentry impersonation events surfaced in Ivanti audit logs (relevant to CVE-2026-5787). Defenders running on-prem EPMM should patch immediately, rotate all EPMM admin and service account credentials post-patch, audit administrative account inventory for unauthorized additions during the disclosure window, restrict the EPMM admin portal to a management VLAN where possible, and hunt for the chained exploitation pattern in webserver access logs and process-execution telemetry.

MITRE ATT&CK techniques used in TL-2026-0477

Collection

T1005 Data from Local System; T1602 Data from Configuration Repository

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.003 Valid Accounts: Local Accounts

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1573.002 Encrypted Channel: Asymmetric Cryptography

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1087.001 Account Discovery: Local Account

Credential Access

T1110.004 Brute Force: Credential Stuffing; T1552.001 Unsecured Credentials: Credentials In Files; T1649 Steal or Forge Authentication Certificates

Persistence

T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Impact

T1531 Account Access Removal

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

defense-impairment

T1553 Subvert Trust Controls; T1553.004 Subvert Trust Controls: Install Root Certificate; T1685.006 Clear Linux or Mac System Logs

Resource Development

T1587.004 Develop Capabilities: Exploits

Reconnaissance

T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Ivanti Endpoint Manager Mobile (EPMM) Improper Input

  • Ivanti — Endpoint Manager Mobile (EPMM)
    Vulnerable versions: 12.8.0.0 and earlier (on-prem); 12.7.0.0; 12.6.1.0 and earlier in 12.6.x branch
    Fixed in: 12.6.1.1; 12.7.0.1; 12.8.0.1
  • Ivanti — Neurons for MDM (cloud)
    Fixed in: Not affected
  • Ivanti — Endpoint Manager (EPM)
    Fixed in: Not affected
  • Ivanti — Sentry
    Fixed in: Not affected

Remediation for Ivanti Endpoint Manager Mobile (EPMM) Improper Input

Patches

  • Ivanti EPMM 12.6.1.1
  • Ivanti EPMM 12.7.0.1
  • Ivanti EPMM 12.8.0.1

Immediate actions

  • Apply Ivanti EPMM patches: upgrade to 12.6.1.1, 12.7.0.1, or 12.8.0.1 immediately on all on-prem EPMM cores
  • Rotate ALL EPMM administrative and service account credentials after patching — Ivanti explicitly recommends this beyond the standard patch step, indicating in-the-wild credential abuse
  • Audit the EPMM administrator account inventory and remove any unauthorized admin accounts created during the zero-day exploitation window (pre-2026-05-07)
  • Restrict EPMM admin web portal access to a dedicated management VLAN or VPN — block direct internet exposure of the /mifs/admin and /mifs/services endpoints
  • Hunt for unexpected child processes spawned by the EPMM service account (tomcat/jboss user) and abnormal outbound connections from EPMM cores
  • Federal civilian agencies: comply with CISA BOD 22-01 by the KEV-assigned remediation deadline (21 days from 2026-05-07)

Workarounds

  • If patching cannot be performed immediately, restrict EPMM administrative web access to management network ranges only via firewall ACLs or reverse proxy IP allowlists
  • Disable any non-essential EPMM administrative integrations and revoke their API tokens until patched
  • Increase logging verbosity on EPMM admin authentication and administrative API endpoints

Longer-term hardening

  • Place EPMM cores behind a reverse proxy with WAF rules for the /mifs/services and /mifs/admin paths
  • Migrate from on-prem EPMM to Ivanti Neurons for MDM (cloud) where business requirements allow — cloud variant is not affected
  • Deploy host-based EDR on EPMM appliances with behavioral detections for tomcat/jboss process anomalies
  • Forward EPMM audit logs and webserver access logs to the SIEM with correlation rules for chained pre-auth method invocation followed by administrator privilege grants
  • Establish a quarterly credential rotation schedule for all EPMM administrative and integration accounts
  • Subscribe to Ivanti security advisories and CISA KEV updates for early warning on this product family, which has a multi-year pattern of zero-day exploitation

CVEs associated with Ivanti Endpoint Manager Mobile (EPMM) Improper Input

CVE-2026-6973

Weaknesses (CWE) in Ivanti Endpoint Manager Mobile (EPMM) Improper Input

CWE-20

Timeline of Ivanti Endpoint Manager Mobile (EPMM) Improper Input

  • Ivanti discloses CVE-2026-1281 and CVE-2026-1340 — two prior on-prem EPMM zero-days actively exploited in the wild, establishing a multi-quarter pattern of EPMM zero-day exploitation and prefiguring credential-rotation guidance later repeated in May 2026.
  • Estimated start of the limited in-the-wild exploitation window for CVE-2026-6973 — Ivanti's later disclosure of 'limited' active exploitation implies a small, targeted operation conducted in the weeks preceding the May 7 advisory.
  • Ivanti privately becomes aware of in-the-wild exploitation activity targeting on-prem EPMM cores and begins coordinated triage of the underlying input-validation defect plus four related access-control and certificate-validation bugs in the same product line.
  • Threadlinqs Intelligence platform ingests CVE-2026-6973 as TL-2026-0477 (HIGH severity, ACTIVE status) for full research, simulation, and detection coverage by the AII-Researcher pipeline.
  • Shadowserver dashboards reflect approximately 850 internet-exposed Ivanti EPMM fingerprinted hosts globally — 508 in Europe and 182 in North America — establishing the pre-patch attack surface.
  • BleepingComputer publishes 'Ivanti warns of new EPMM flaw exploited in zero-day attacks' summarizing the bundled advisory, the active exploitation, and Ivanti's explicit guidance to rotate EPMM administrative credentials post-patch.
  • CISA adds CVE-2026-6973 to the Known Exploited Vulnerabilities (KEV) Catalog, triggering Binding Operational Directive 22-01 and a 21-day federal civilian remediation deadline.
  • NVD publishes CVE-2026-6973 with a Secondary CVSS 3.1 Base Score of 7.2 HIGH (vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and assigns CWE-20 Improper Input Validation.
  • Ivanti publishes the May 2026 EPMM Security Advisory on hub.ivanti.com, disclosing CVE-2026-6973 (CWE-20 Improper Input Validation, CVSS 7.2 HIGH) along with CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821, and ships fixed builds 12.6.1.1, 12.7.0.1, and 12.8.0.1.
  • Projected CISA BOD 22-01 federal civilian remediation deadline (21 days from KEV addition) for CVE-2026-6973 — federal agencies must complete patching, mitigation, or service removal by this date.
  • As of 2026-05-29, CVE-2026-6973 remains an active concern: it is a confirmed CISA KEV zero-day still being exploited in targeted attacks via admin credentials harvested from the Jan 2026 EPMM bugs, with 800+ exposed appliances and no takedown. Patches exist (12.6.1.1/12.7.0.1/12.8.0.1) but unrotated creds and unpatched on-prem cores keep risk live.

Sources cited for Ivanti Endpoint Manager Mobile (EPMM) Improper Input

Threats related to Ivanti Endpoint Manager Mobile (EPMM) Improper Input

Detection coverage for TL-2026-0477

As of 2026-05-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0477 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats