CVE-2026-6973

What it actually does

CVE-2026-6973 is an improper input validation flaw in Ivanti Endpoint Manager Mobile (EPMM) that allows a remotely authenticated user with administrative privileges to execute arbitrary code on the EPMM server. Because exploitation is network-accessible, low-complexity, and requires no user interaction, any compromised or malicious EPMM administrator account can potentially turn administrative application access into operating-system-level execution. Successful exploitation can lead to full compromise of the EPMM appliance, including access to managed mobile-device data, configuration secrets, enrollment infrastructure, and the ability to modify or disrupt device-management operations.

Why it matters to the business

Ivanti EPMM is commonly used to manage enterprise mobile devices, so compromise can affect device enrollment, policy enforcement, application distribution, and access controls for mobile fleets. An attacker who gains code execution on EPMM may be able to steal sensitive configuration data, pivot to connected identity or management systems, alter mobile security policies, disrupt mobile operations, or use the appliance as a trusted foothold inside the network. This vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and the remediation deadline of 2026-05-10 has passed, making unpatched internet-accessible or broadly reachable EPMM instances a high-priority operational risk despite the requirement for administrative credentials.

How an attack unfolds

An attacker first obtains or abuses valid administrative access to Ivanti EPMM, commonly through credential theft, phishing, session compromise, password reuse, or prior compromise of an administrator account. Once authenticated, the attacker sends crafted input to a vulnerable EPMM function that fails to validate the supplied data correctly. The vulnerable server-side component processes that input in a way that allows attacker-controlled commands or code to run on the appliance. After gaining execution, the attacker may run discovery commands, establish persistence, deploy web shells or scripts, collect EPMM configuration and secrets, access managed-device information, alter mobile-management policies, or use the appliance to move laterally. Active exploitation has been reported in the wild, with campaign context referencing ClickFix/FakeCaptcha-style poisoning activity and Ivanti EPMM exploitation, so defenders should treat suspicious administrative logins followed by unusual server-side command execution as a strong compromise signal.

How to fix it

Upgrade Ivanti Endpoint Manager Mobile to a fixed release immediately. Versions earlier than 12.6.1.1, 12.7.0.1, and 12.8.0.1 are affected; upgrade to 12.6.1.1, 12.7.0.1, 12.8.0.1, or a later vendor-supported release in the applicable branch. Because this vulnerability is in CISA KEV and is actively exploited, do not rely on compensating controls as a long-term fix. Until patching is complete, restrict EPMM administrative access to trusted management networks or VPNs, enforce phishing-resistant MFA for administrators, review and reduce administrative accounts, rotate credentials for EPMM administrators and service integrations, and monitor for suspicious administrative activity. If exploitation is suspected, isolate the appliance, preserve forensic evidence, rebuild from trusted media if integrity cannot be verified, and rotate secrets that may have been accessible from the server.

How to confirm the fix worked

Confirm the running Ivanti EPMM version from the administrative console or appliance version command and verify it is 12.6.1.1, 12.7.0.1, 12.8.0.1, or later. Validate that all EPMM nodes, appliances, standby systems, and disaster-recovery images have been updated, not just the primary instance. Confirm that administrative access is limited to approved networks and protected by MFA. Review vendor advisories and release notes to ensure the correct branch-specific fix is installed. Perform an authenticated configuration review to confirm there are no unexpected administrator accounts, API integrations, scheduled jobs, modified application files, or unauthorized policy changes. If vulnerability scanning is used, ensure scanners check the authenticated product version and do not rely only on banner detection.

Typical attack path

1. Identify an exposed or reachable Ivanti Endpoint Manager Mobile instance.
2. Obtain valid EPMM administrative credentials or hijack an administrative session.
3. Authenticate to the EPMM administrative interface.
4. Submit specially crafted input to the vulnerable administrative functionality.
5. Trigger improper validation and cause server-side code or command execution.
6. Run reconnaissance commands and identify the appliance operating context, privileges, network access, and stored secrets.
7. Deploy persistence such as a web shell, scheduled task, startup script, or modified application component.
8. Exfiltrate configuration data, credentials, logs, device-management data, or enrollment-related secrets.
9. Modify EPMM policies or use the appliance as a pivot point to access adjacent systems.
10. Cover tracks by deleting logs, rotating timestamps, removing tools, or using legitimate administrative functions to blend in.

How to detect it

Review EPMM administrative audit logs, web access logs, application logs, operating-system logs, authentication logs, proxy logs, EDR telemetry, and network flow data for signs of authenticated exploitation. Focus on sequences where an administrative login is followed by unusual requests, server-side errors, unexpected file creation, command execution, outbound network connections, or changes to device-management policies. Investigate administrator logins from unfamiliar IP addresses, anonymization infrastructure, impossible-travel locations, new user agents, or times inconsistent with normal administration. On the appliance, look for new or modified web-accessible files, scripts in temporary directories, unexpected cron/systemd entries, unusual child processes spawned by Java/Tomcat/application server processes, and outbound connections to unknown hosts. Because ClickFix/FakeCaptcha-style campaigns are associated with social engineering and credential theft, correlate EPMM administrative logins with recent phishing, fake browser update, fake CAPTCHA, or clipboard-command execution alerts affecting administrator workstations. If exploitation is suspected, preserve volatile data, collect full logs before rebooting, compare application directories against a known-good version, and rotate credentials after containment.

• admin login followed by command execution
• unexpected administrator account created
• unexpected EPMM policy change
• unexpected device wipe command
• unexpected device enrollment profile change
• java.lang.ProcessBuilder
• Runtime.getRuntime
• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell -enc
• wget http
• curl http
• chmod +x /tmp
• /tmp/.
• /var/tmp/.
• nc -e
• ncat -e
• bash -i
• python -c
• perl -e
• crontab -e
• /etc/cron.d/
• /etc/systemd/system/
• /var/log/tomcat
• /opt/ivanti
• /mi/tomcat
• webshell
• jsp shell
• cmd.jsp
• shell.jsp
• /api/v2/
• FakeCaptcha
• ClickFix

What your security team should do

• Treat this as urgent for any unpatched EPMM instance because it is KEV-listed, actively exploited, and past the CISA remediation deadline.
• Inventory all Ivanti Endpoint Manager Mobile deployments, including standby, lab, externally exposed, and disaster-recovery systems.
• Upgrade affected systems to 12.6.1.1, 12.7.0.1, 12.8.0.1, or later as appropriate for the installed branch.
• Restrict administrative access to trusted management networks and require phishing-resistant MFA for all EPMM administrators.
• Audit administrative users, remove stale accounts, rotate administrator passwords, and review recent authentication events for suspicious source IPs or impossible travel.
• Hunt for evidence of exploitation before and after patching, focusing on administrative logins followed by unusual command execution, file writes, outbound connections, or policy changes.
• Rotate EPMM-related service credentials, API tokens, certificates, and integration secrets if compromise is suspected.
• Preserve logs and appliance snapshots before remediation when feasible to support forensic investigation.
• If web shells, unknown binaries, or unexplained server modifications are found, rebuild the appliance from trusted media rather than relying only on file cleanup.
• Add targeted monitoring for unusual outbound traffic from EPMM appliances, especially to newly registered domains, paste sites, file-sharing services, or command-and-control infrastructure.