[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqIRrbxtzLWjlwrKpKUelOtuV_nrX_MGvb4HmTqJY7k0":3},{"article":4,"iocs":46,"watch_terms":68,"solutions":69,"lesson":27},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"73e53bd1-f1cc-4376-a06c-964b8bf511ab","Ivanti Warns of New EPMM Zero-Day Exploited Using Credentials Stolen in January Attacks","ivanti-warns-of-new-epmm-zero-day-exploited-using-credentials-stolen-in-january--e9ccc0","Ivanti has issued an urgent security advisory for its Endpoint Manager Mobile (EPMM) product, disclosing five vulnerabilities including one that is actively exploited in the wild.","Ivanti disclosed CVE-2026-6973, a high-severity authenticated RCE vulnerability in Endpoint Manager Mobile (EPMM) that is actively exploited in the wild. Attackers are leveraging admin credentials stolen during January 2026 exploitation of CVE-2026-1281 and CVE-2026-1340 to chain attacks. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a three-day federal agency mitigation deadline.","Ivanti EPMM zero-day CVE-2026-6973 actively exploited using credentials stolen in January attacks.","https:\u002F\u002Fdarkwebinformer.com\u002Fivanti-warns-of-new-epmm-zero-day-exploited-using-credentials-stolen-in-january-attacks\u002F","https:\u002F\u002Fstorage.ghost.io\u002Fc\u002F6b\u002F16\u002F6b16ac9c-cd67-432f-b0f3-bbec941084ff\u002Fcontent\u002Fimages\u002F2026\u002F05\u002Fivanti.png","2026-05-07T18:03:55+00:00","2026-05-07T19:00:08.599+00:00",9,[17,20,23],{"name":18,"type":19},"Ivanti","vendor",{"name":21,"type":22},"Endpoint Manager Mobile (EPMM)","product",{"name":24,"type":22},"Ivanti Neurons for MDM","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":25,"icon":27,"name":28,"slug":29},null,"Zero-day","zero-day",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[47,51,54,56,59,62,65],{"type":48,"value":49,"context":50},"cve","CVE-2026-6973","Active zero-day RCE in Ivanti EPMM requiring admin credentials; CVSS 7.2",{"type":48,"value":52,"context":53},"CVE-2026-1281","Critical unauthenticated RCE in EPMM from January 2026; credentials stolen for chained attacks",{"type":48,"value":55,"context":53},"CVE-2026-1340",{"type":48,"value":57,"context":58},"CVE-2026-5786","High-severity privilege escalation in EPMM; no confirmed exploitation",{"type":48,"value":60,"context":61},"CVE-2026-5787","High-severity certificate impersonation in EPMM; no confirmed exploitation",{"type":48,"value":63,"context":64},"CVE-2026-5788","High-severity improper access control in EPMM; no confirmed exploitation",{"type":48,"value":66,"context":67},"CVE-2026-7821","High-severity certificate validation issue in EPMM; no confirmed exploitation",[18,21,24],{"controls":70,"vendors":153},[71,99,128],{"slug":72,"name":73,"problem":74,"products":75},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[76,84,91],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":72,"product_name":88,"url":89,"description":90},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":100,"name":101,"problem":102,"products":103},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":129,"name":130,"problem":131,"products":132},"patch-management","Automated patch management","Known holes get closed in days, not months.",[133,140,145],{"vendor_slug":134,"vendor_name":18,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":141,"product_name":142,"url":143,"description":144},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[154],{"slug":134,"name":18,"logo_path":135,"roles":155},[156,157],"affected","reported_by"]