CVE-2026-6973KEV · OVERDUECWE-20

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

High · published May 7, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 84.8th percentile for exploit probability.

166
days past CISA
deadline
CVSS v3.1
7.2
EPSS
3%
Percentile
84.8
In the wild
Confirmed
What it is

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02537 · 84.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-05-07T15:21Z
KEV added
2026-05-07 · due 2026-05-10
EPSS history
Timeline
  • 25 SEP 03:27Z
    EPSS moved 34% → 3%
    epss
  • 07 MAY 15:21Z
    An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to…
    cvelistv5
  • 07 MAY 00:00Z
    Added to CISA KEV — remediate by May 10
    kev