Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-6973

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

7.2
CVSS 3.1
1
story
MAY 7
added to KEV
Severity
7.2 High · vendor score
Vendor
Ivanti
Product
Endpoint Manager Mobile (EPMM)
Published
May 7, 2026
Added to KEV
May 7, 2026
KEV deadline
May 10, 2026
Ransomware use
Unknown
Weakness
CWE-20

What it is

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesIvanti Warns of Exploited EPMM Flaw CVE-2026-6973The vulnerability (CVE-2026-6973) exists in Ivanti Endpoint Manager Mobile (EPMM) is being exploited by threat actors.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryhub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs