Trending
CVE-2026-6973

CVE detail

CVE-2026-6973

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

CVSS 7.2 · HighBuzz score 69.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 69.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 24.0 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0

Mention score

24.0

10 evidence mentions in the snapshot

Diversity score

20.0

7 sources across 4 categories

KEV score

25.0

Known exploited vulnerability present

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 0; within the 30d window
Peak daily: 0; highest bucket

Evidence

Source links by recency

Newest mentions first

10 source links · newest first

Critical Vulnerabilities Patched in Fortinet, Ivanti ProductsSecurityWeek
Two OS command injection flaws can be exploited remotely, without authentication, for arbitrary code execution.
newswww.securityweek.comJun 10, 2026, 8:50 AM
11th May – Threat Intelligence ReportCheck Point Research
For the latest discoveries in cyber research for the week of 11th May, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Instructure, the US education technology company behind the Canvas learning platform, has confirmed a major data breach affecting its cloud-hosted environment. Exposed data reportedly includes student and staff records and private messages, while […]
vendorresearch.checkpoint.comMay 11, 2026, 12:49 PM
Security Affairs newsletter Round 576 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Quasar Linux RAT (QLNX): A Fileless Linux Implant Built for Stealth and Persistence Braintrust security incident […]
newssecurityaffairs.comMay 10, 2026, 8:20 AM
Week in review: cPanel vulnerability actively exploited, DigiCert breach, LinkedIn job scamsHelp Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Your work apps are quietly handing 19 data points to someone Office work in 2026 relies on mobile apps used alongside personal tools like banking and messaging. Ten widely used workplace apps, including Gmail, Microsoft Teams, Zoom, Slack, and Notion, have over 12.5 billion Google Play downloads. Research from Incogni shows these apps collect an average of 19 data points … More →
newswww.helpnetsecurity.comMay 10, 2026, 8:00 AM
Five new holes, one exploited, found in Ivanti Endpoint Manager MobileCSO Online
The five new vulnerabilities discovered in Ivanti’s on-premises mobile endpoint management solution are a “classic example of the legacy trap” that CSOs must avoid, says an expert. “Patch today to survive the weekend,” said Robert Enderle of the Enderle Group, “but start planning your exit from legacy MDM as soon as possible.” He was commenting […]
newswww.csoonline.comMay 8, 2026, 9:01 PM
Ivanti EPMM vulnerability exploited in zero-day attacks (CVE-2026-6973)Help Net Security
Ivanti has released fixes for 5 high-severity vulnerabilities in its Endpoint Manager Mobile (EPMM) solution, one of which (CVE-2026-6973) has being exploited as a zero-day by attackers. “We are aware of a very limited number of customers exploited with CVE-2026-6973,” the company said in a security advisory published on Thursday. About CVE-2026-6973 CVE-2026-6973 is caused by improper input validation and allows remote attackers with administrative privileges to execute arbitrary code on vulnerable instances. “If customers … More →
newswww.helpnetsecurity.comMay 8, 2026, 10:30 AM
Ivanti Patches EPMM Zero-Day Exploited in Targeted AttacksSecurityWeek
CVE-2026-6973 is a high-severity vulnerability that allows an attacker who has admin privileges to execute arbitrary code.
newswww.securityweek.comMay 8, 2026, 5:41 AM
U.S. CISA adds a flaw in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities catalogSecurity Affairs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in the Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-6973 (CVSS score of 7.1), to its Known Exploited Vulnerabilities (KEV) catalog. Ivanti warns customers […]
newssecurityaffairs.comMay 7, 2026, 6:03 PM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-6973www.cisa.gov
No excerpt available.
Mitigationwww.cisa.govMay 7, 2026, 4:16 PM
https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEshub.ivanti.com
No excerpt available.
Vendor Advisoryhub.ivanti.comMay 7, 2026, 4:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-54272
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4…
CVSS 6.9 · Medium
1 mention
CVE-2026-46452
Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unsta…
CVSS 5.3 · Medium
3 mentions
CVE-2026-54120
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
CVSS 9.9 · Critical
1 mention
CVE-2026-65604
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds…
CVSS 8.8 · High
2 mentions
CVE-2026-47668
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the…
CVSS 10.0 · Critical
3 mentions
CVE-2026-16723
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType…
CVSS 9.0 · Critical
Public PoC observed3 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2026-6973.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:a:ivanti:endpoint_manager_mobileSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2026-6973Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Analyzed

Published

May 7, 2026

Modified

Jun 17, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE IDs

Vendor classifications

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): High. The attacker needs significant administrative privileges.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Unchanged. Impacts remain within the vulnerable security authority.
Confidentiality Impact (C): High. There is a total or serious impact to this security property.
Integrity Impact (I): High. There is a total or serious impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

1 stored signals · KEV present · 0 OTX pulses

KEVKEV
- cwes: CWE-20
- dueDate: 2026-05-10
- knownRansomwareCampaignUse: Unknown
- notes: https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2026-6973
- product: Endpoint Manager Mobile (EPMM)
- requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- shortDescription: Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
- vendorProject: Ivanti
- vulnerabilityName: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Observed May 7, 2026, 12:00 AM