Ivanti EPMM (Endpoint Manager Mobile) Remote Code Execution Vulnerability Advisory (CVE-2026-6973)

1. Apply Official Security Patches

Upgrade your Ivanti EPMM instances to the designated patched releases immediately:

• For EPMM 12.6.x: Upgrade to 12.6.1.1 or higher
• For EPMM 12.7.x: Upgrade to 12.7.0.1 or higher
• For EPMM 12.8.x: Upgrade to 12.8.0.1 or higher

2. Temporary Mitigations & Monitoring

If immediate patching is not feasible, implement the following measures to reduce exposure:

• Restrict Administrative Access: Block external internet access to the EPMM Admin Portal and API ports. Restrict access to trusted internal IP ranges or via a secure VPN only.
• Audit Administrative Accounts: Review all accounts with administrative privileges for unauthorized or suspicious creation, and enforce Multi-Factor Authentication (MFA) across all admin accounts.
• Log Monitoring: Inspect admin portal access logs and configuration change history for anomalous command execution attempts or logins from unrecognized IP addresses.

This vulnerability (CVE-2026-6973) is caused by Improper Input Validation (CWE-20) within Ivanti EPMM (formerly MobileIron Core).

A remotely authenticated attacker with administrative access can exploit this flaw by sending crafted inputs to specific administrative interfaces or API endpoints. Due to the lack of strict validation, the application processes these inputs as system commands, leading to Remote Code Execution (RCE). Although administrative privileges (PR:H) are required for exploitation, this vulnerability is highly critical as evidenced by its inclusion in the CISA KEV catalog and an extremely high EPSS score of 0.94, indicating active exploitation in the wild. Successful exploitation results in a complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).