High‑Severity RCE in Ivanti Endpoint Manager Mobile (CVE‑2026‑6973)
What It Is
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input‑validation flaw that permits a remotely‑authenticated user with administrative privileges to execute arbitrary code on the management server. The vulnerability is classified as High severity by CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Exploitability
Exploitation requires a valid administrative account, but once obtained the attacker can run code with the same privileges as the EPMM service. No public proof‑of‑concept has been released, yet the vulnerability is listed in CISA’s KEV program, indicating active or imminent exploitation risk.
Affected Products
- Vendor: Ivanti
- Product: Endpoint Manager Mobile (EPMM) – all versions prior to the vendor‑released patch.
Why It Matters for Compliance & Audit Readiness
The flaw directly challenges access‑control and privileged‑account management controls that are core to frameworks such as NIST CSF and ISO 27001. Demonstrating that you have:
- Mapped privileged access to a control in your Trust Center,
- Monitored admin activity with immutable logs, and
- Maintained a defensible patch‑management evidence trail
provides auditors with concrete proof of due diligence and a resilient control environment. Failure to remediate could be interpreted as a lapse in continuous control monitoring, jeopardizing compliance attestations.
Recommended Actions
- Patch immediately with Ivanti’s security update for CVE‑2026‑6973.
- Validate that the patch is applied across all EPMM instances via automated inventory.
- Review and tighten administrative role assignments; enforce least‑privilege principles.
- Enable comprehensive logging of EPMM admin actions and integrate with your SIEM for real‑time alerting.
- Document the remediation steps and update your control‑mapping artifacts to reflect the mitigated risk.
Source: CISA KEV – CVE‑2026‑6973