Ivanti EPMM CVE-2026-6973

Remote authenticated administrator access to Ivanti EPMM. The attacker must possess valid credentials for an account with administrative privileges (PR:H) in the EPMM system. The vulnerable input validation flaw is accessible through network-exposed administrative interfaces, likely the EPMM web console or administrative API endpoints. No special deployment configuration, non-default feature enablement, or user interaction (UI:N) required beyond standard administrative access. Exploitation is limited to versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. The high privileges requirement significantly limits the attacker pool to those who have already compromised administrative credentials through separate attack vectors.

Real-world risk is moderate despite the 7.2 CVSS score. The high privileges requirement (PR:H) significantly constrains exploitation - attackers must first compromise valid EPMM administrative credentials through phishing, credential stuffing, or lateral movement from other breached systems. Low attack complexity (AC:L) means exploitation is straightforward once authenticated, requiring no special timing or race conditions. No EPSS data, KEV listing, or public POC identified, indicating this is not yet actively exploited or weaponized. However, Ivanti products have been frequent targets in 2025-2026, with multiple EPMM vulnerabilities (CVE-2023-35078, CVE-2023-35081) appearing in CISA KEV, suggesting threat actors monitor this product closely. The administrative scope limitation reduces blast radius compared to unauthenticated RCE, but complete system compromise (C:H/I:H/A:H) enables persistent backdoors, data exfiltration, and pivot points for broader enterprise compromise. Organizations with exposed EPMM admin interfaces or weak credential controls face elevated risk.

An attacker who has compromised EPMM administrator credentials through credential theft or phishing authenticates to the EPMM administrative interface over the network. Exploiting the input validation flaw in an administrative function, the attacker submits crafted input containing malicious code that bypasses sanitization checks. The EPMM server processes this input, executing the attacker's code with the privileges of the EPMM service, granting full system control to establish persistence, exfiltrate managed device data, or pivot to connected enterprise systems.