DaystoPatch

IvantiExploited incident

Ivanti EPMM authenticated admin RCE exploited as a zero-day (May 2026)

CVE-2026-6973High, CVSS 7.2In CISA's Known Exploited Vulnerabilities catalog since 7 May 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Ivanti blog RSS feed, item 'May 2026 EPMM Security Update'CuratedQuote verified

    Thu, 07 May 2026 14:23:06 Z

    pubDate of the 'May 2026 EPMM Security Update' item. Ivanti's own disclosure (which already reported limited exploitation) is the earliest public signal found. The feed is a rolling list; this item will eventually drop off it.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2026-6973)ClaimedQuote verified7 May 2026

    Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

    Added to CISA's KEV catalog on 2026-05-07.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti blog: May 2026 EPMM Security UpdateCuratedQuote verified7 May 2026

    At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation.

    Page shows 'Last updated: May 07, 2026'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti blog postClaimedQuote verified7 May 2026, 14:23 UTC

    At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation.

    The vendor's own disclosure.

    Source
    Ivanti blog post vendor blog
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-6973ClaimedQuote verified7 May 2026, 15:21 UTC

    An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9b8517b5805a888a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet7 May 2026, 16:00 UTC

    🔗 CVE : CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, CVE-2026-6973, CVE-2026-7821

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Ivanti blog postClaimedQuote verified

    At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation.

    Source
    Ivanti blog post vendor blog
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    Ivanti blog RSS feed, item 'May 2026 EPMM Security Update'CuratedQuote verified7 May 2026, 14:23 UTC

    Thu, 07 May 2026 14:23:06 Z

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2026-6973 (CNA: Ivanti)CuratedQuote verified7 May 2026, 15:21 UTC

    "datePublished":"2026-05-07T15:21:24.849Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9b8517b5805a888a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti blog postClaimedQuote verified9 Jun 2026, 14:06 UTC

    June 2026 Security Update

    From the advisory's revision history.

    Source
    Ivanti blog post vendor blog
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Ivanti blog: May 2026 EPMM Security UpdateCuratedQuote verified

    we strongly encourage our customers to apply the patch to their on-premises EPMM promptly to protect their environment.

    Help Net Security (2026-05-08): 'Ivanti has released fixes for 5 high-severity vulnerabilities in its Endpoint Manager Mobile (EPMM) solution'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1741fed468bce08b…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    CVE record CVE-2026-6973 (CNA: Ivanti)CuratedQuote verified

    12.6.1.1, 12.7.0.1, and 12.8.0.1

    Fixed releases for all three supported lines (12.6, 12.7, 12.8) are named in the record published on the disclosure day. The record was updated 2026-06-11, so this is dated to the disclosure day on the strength of the blog's 'apply the patch' wording rather than a timestamped fix list.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9b8517b5805a888a…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Ivanti Endpoint Manager Mobile (EPMM, on-premises)
How we built this timeline

Zero-day acknowledged at disclosure (Thursday 7 May 2026). The advisory ('May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs') fixed five high-severity EPMM flaws per Help Net Security; only CVE-2026-6973 is in KEV, and the other CVE IDs were not confirmed, so they are not listed.

Exploitation requires EPMM admin credentials; Ivanti linked reduced risk to rotating credentials after the January 2026 EPMM zero-days (CVE-2026-1281/CVE-2026-1340).

A June 2026 Ivanti EPMM advisory URL names CVE-2026-6973 together with CVE-2026-10727 (fixed in 12.7.0.2 / 12.8.0.3 / 12.9.0.1); its relationship to this fix was not established. The Ivanti advisory pages are JavaScript-only.

Related

Ivanti report card