Ivanti Warns of New EPMM Zero-Day Exploited Using Credentials Stolen in January Attacks
Ivanti EPMM zero-day CVE-2026-6973 actively exploited using credentials stolen in January attacks.
Ivanti disclosed CVE-2026-6973, a high-severity authenticated RCE vulnerability in Endpoint Manager Mobile (EPMM) that is actively exploited in the wild. Attackers are leveraging admin credentials stolen during January 2026 exploitation of CVE-2026-1281 and CVE-2026-1340 to chain attacks. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a three-day federal agency mitigation deadline.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ivanti?
Get an email when a new story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-6973
- cve — CVE-2026-1281
- cve — CVE-2026-1340
- cve — CVE-2026-5786
- cve — CVE-2026-5787
- cve — CVE-2026-5788
- cve — CVE-2026-7821