# Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Authenticated RCE Zero-Day — CVE-2026-6973 (CISA KEV, Active Exploitation)

> Ivanti disclosed CVE-2026-6973, a CWE-20 Improper Input Validation flaw in on-prem Endpoint Manager Mobile (EPMM) 12.8.0.0 and earlier that lets a remotely authenticated administrator achieve arbitrary code execution on the appliance (CVSS 7.2 HIGH). Ivanti confirmed limited in-the-wild zero-day exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities Catalog on 2026-05-07 with a federal remediation deadline. The bug is one of five CVEs (CVE-2026-5786/5787/5788/7821 and CVE-2026-6973) shipped together in the May 2026 EPMM advisory; chaining the unauthenticated access-control bugs with CVE-2026-6973 yields a full pre-auth-to-RCE path on unpatched on-prem EPMM cores.

- **Published:** 2026-05-07T12:00:00Z
- **Last reviewed:** 2026-05-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0477
- **ID:** TL-2026-0477
- **Severity:** HIGH (CVSS 7.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-6973, CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, CVE-2026-7821

## Description

CVE-2026-6973 is the actively exploited zero-day in Ivanti's May 2026 Endpoint Manager Mobile (EPMM) security advisory. The vulnerability is classified as CWE-20 Improper Input Validation, scored CVSS 3.1 7.2 HIGH (vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and lives in unspecified administrative endpoints of the EPMM core appliance. A remote attacker who already holds administrative access to the EPMM web console can submit crafted input that bypasses server-side validation and is interpreted by the underlying runtime, yielding arbitrary code execution as the EPMM service account on the appliance host. EPMM appliances run as the central trust anchor for enterprise mobile fleets — they hold MDM enrollment certificates, push notification keys, Active Directory bind credentials, certificate authority private keys, VPN profiles, Wi-Fi credentials, and policy payloads — so RCE on the core is a high-value pivot point into both the corporate network and tens of thousands of managed mobile endpoints.

Ivanti shipped CVE-2026-6973 alongside four other CVEs in the same May 2026 EPMM advisory: CVE-2026-5786 (CWE-284 Improper Access Control allowing an authenticated user to gain administrative access), CVE-2026-5787 (CWE-295 Improper Certificate Validation enabling impersonation of registered Sentry hosts and theft of valid CA-signed certificates), CVE-2026-5788 (CWE-284 Improper Access Control allowing an unauthenticated remote attacker to invoke arbitrary methods on the EPMM core), and CVE-2026-7821 (CWE-295 Improper Certificate Validation enabling enrollment of devices belonging to a restricted set of unenrolled users). The most plausible end-to-end exploit chain stitches CVE-2026-5788 (unauthenticated method invocation) with CVE-2026-5786 (privilege escalation to administrator) and finally CVE-2026-6973 (administrator-authenticated RCE), giving a fully unauthenticated remote code execution path against any internet-exposed unpatched EPMM core. Ivanti's explicit recommendation to rotate EPMM administrative credentials post-patch — beyond the standard "apply patch" guidance — strongly implies that observed in-the-wild operators are reusing or harvesting EPMM admin credentials, consistent with the credential-theft tradecraft seen in the January 2026 EPMM zero-days CVE-2026-1281 and CVE-2026-1340.

CISA added CVE-2026-6973 to the Known Exploited Vulnerabilities (KEV) Catalog on 2026-05-07, the same day Ivanti disclosed the advisory, triggering Binding Operational Directive 22-01 and a 21-day federal civilian remediation deadline. The Shadowserver Foundation tracks roughly 850+ internet-exposed Ivanti EPMM fingerprints globally — 508 in Europe, 182 in North America — most of which remain attributable to a small set of repeatedly targeted regulated sectors (government, defense industrial base, financial services, healthcare, telecom, education). Ivanti has not publicly attributed the activity. However, the EPMM product line has a sustained history of zero-day exploitation by the China-nexus UNC5221 cluster (Ivanti Connect Secure 2024, EPMM January 2026 CVE-2026-1281/1340), and the limited-scope, credential-harvesting tradecraft seen here is consistent with that actor cluster pending public attribution. Patches are available in EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1; cloud Ivanti Neurons for MDM, Ivanti EPM (desktop), and Ivanti Sentry are explicitly not affected.

Detection-relevant indicators include unexpected child processes spawned by EPMM service users (typically tomcat/jboss-style runtimes), abnormal outbound connections from EPMM cores to non-corporate infrastructure, modification of EPMM webapp directories outside scheduled patch windows, creation of new administrator accounts in the EPMM console, and Sentry impersonation events surfaced in Ivanti audit logs (relevant to CVE-2026-5787). Defenders running on-prem EPMM should patch immediately, rotate all EPMM admin and service account credentials post-patch, audit administrative account inventory for unauthorized additions during the disclosure window, restrict the EPMM admin portal to a management VLAN where possible, and hunt for the chained exploitation pattern in webserver access logs and process-execution telemetry.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1203 Exploitation for Client Execution
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1068 Exploitation for Privilege Escalation
- T1078.003 Valid Accounts: Local Accounts
- T1553 Subvert Trust Controls
- T1553.004 Subvert Trust Controls: Install Root Certificate
- T1685.006 Clear Linux or Mac System Logs
- T1552.001 Unsecured Credentials: Credentials In Files
- T1649 Steal or Forge Authentication Certificates
- T1110.004 Brute Force: Credential Stuffing
- T1082 System Information Discovery
- T1087.001 Account Discovery: Local Account
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1005 Data from Local System
- T1602 Data from Configuration Repository
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [CISA KEV Addition: CVE-2026-6973 Ivanti EPMM Improper Input Validation Vulnerability](https://www.cisa.gov/news-events/alerts/2026/05/07/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Ivanti May 2026 Security Advisory: Endpoint Manager Mobile (EPMM) Multiple CVEs](https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US)
- [NVD: CVE-2026-6973](https://nvd.nist.gov/vuln/detail/CVE-2026-6973)
- [NVD: CVE-2026-5786](https://nvd.nist.gov/vuln/detail/CVE-2026-5786)
- [NVD: CVE-2026-5787](https://nvd.nist.gov/vuln/detail/CVE-2026-5787)
- [NVD: CVE-2026-5788](https://nvd.nist.gov/vuln/detail/CVE-2026-5788)
- [NVD: CVE-2026-7821](https://nvd.nist.gov/vuln/detail/CVE-2026-7821)
- [Ivanti warns of new EPMM flaw exploited in zero-day attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-epmm-flaw-exploited-in-zero-day-attacks/)
- [Shadowserver: Ivanti EPMM Exposure Tracking Dashboard](https://dashboard.shadowserver.org/)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [MITRE CWE-20 — Improper Input Validation](https://cwe.mitre.org/data/definitions/20.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0477