CVE-2026-6973
Published: 07 May 2026
Summary
CVE-2026-6973 is a high-severity Improper Input Validation (CWE-20) vulnerability in Ivanti Endpoint Manager Mobile. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-5 (Access Restrictions for Change).
Deeper analysis
CVE-2026-6973 is a configuration control vulnerability affecting Ivanti Endpoint Manager Mobile versions prior to 12.9.0.1, 12.8.0.3, and 12.7.0.2. The flaw, tracked under CWE-15, permits injection of arbitrary Apache directives through insufficient validation of configuration controls, which can be leveraged for remote code execution on the affected system. It carries a CVSS 3.1 base score of 7.2.
A remote attacker who already possesses valid administrative credentials can exploit the issue over the network without user interaction to achieve full control over the target server, including execution of arbitrary code with high impact to confidentiality, integrity, and availability.
The vendor advisory at hub.ivanti.com details the affected releases and directs customers to upgrade to the fixed versions. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation and requiring federal agencies to apply mitigations according to the published timetable.
The EPSS score rose from lower values at disclosure on 2026-05-07 to a peak of 0.0639 on 2026-05-13 before receding to the current 0.0479, indicating a brief period of increased exploitation interest following public release.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-28396
Vulnerability details
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
- CWE(s)
- KEV Date Added
- 07 May 2026
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input validation in a remotely accessible management server (Ivanti EPMM) directly enables remote code execution by an authenticated administrator, mapping to exploitation of a public-facing or remotely exposed application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs (including configuration directives) before processing, blocking the arbitrary Apache directive injection that enables RCE.
Enforces access restrictions and authorization checks on configuration changes, limiting the ability of even authenticated administrators to inject malicious directives.
Requires timely application of vendor patches that remediate the input-validation flaw in Ivanti EPMM configuration handling.