CVE-2026-6973 is an improper input validation vulnerability in Ivanti EPMM that allows remote code execution by an attacker with administrative privileges. It was exploited in targeted attacks against a very limited set of customers. The vulnerability may have been chained with two other Ivanti zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) that permit unauthenticated remote code execution, facilitating full control over the mobile device management infrastructure. Ivanti issued patches in May 2026 to fix this zero-day and four additional vulnerabilities affecting privilege escalation, certificate theft, arbitrary method invocation, and information disclosure. CISA has mandated remediation for federal agencies by May 10, 2026. Ivanti recommends credential rotation to mitigate risk, especially if previously impacted by related vulnerabilities. No further exploitation details or attack vectors have been publicly shared.

The vulnerability enables an attacker with administrative privileges to execute arbitrary code remotely on the Ivanti EPMM platform, potentially leading to full compromise of the mobile device management infrastructure. Exploitation was observed in targeted attacks against a very limited number of customers. The chaining of this vulnerability with others that allow unauthenticated remote code execution increases the risk of complete system takeover. The impact includes unauthorized code execution, privilege escalation, and potential loss of control over managed devices. The vulnerability is considered high severity due to the level of access required and the potential consequences.

Ivanti has released official security updates addressing CVE-2026-6973 and four other vulnerabilities in the EPMM product. Customers should apply these patches immediately. Ivanti also recommends rotating credentials if not already done following previous advisories related to CVE-2026-1281 and CVE-2026-1340, as this significantly reduces exploitation risk. CISA has included this vulnerability in its Known Exploited Vulnerabilities catalog and requires federal agencies to remediate by May 10, 2026. No additional mitigation steps are indicated by the vendor at this time.