CVE-2026-6973: Ivanti EPMM Active Exploitation and Remediation Guide

Introduction

Ivanti has issued a critical warning regarding a high-severity security flaw in its Endpoint Manager Mobile (EPMM), formerly known as MobileIron. Designated as CVE-2026-6973, this vulnerability is not theoretical; it is currently under active exploitation in the wild.

For organizations managing mobile fleets, this represents a significant risk. The vulnerability sits at the intersection of identity management and system control. While it requires an authenticated foothold to trigger, the successful exploitation grants attackers remote code execution (RCE) capabilities at the admin level. Given the role of EPMM in managing corporate devices, a compromise here provides a prime pivot point for lateral movement into the broader network. Defenders must treat this with immediate urgency, prioritating patching and hunting for signs of compromise.

Technical Analysis

• Affected Products: Ivanti Endpoint Manager Mobile (EPMM)
• Affected Versions: Versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1.
• CVE Identifier: CVE-2026-6973
• CVSS Score: 7.2 (High)

Vulnerability Mechanics

At its core, CVE-2026-6973 is a case of improper input validation. From a defender's perspective, the attack chain requires two stages:

1. Authentication: The attacker must first obtain a valid session for a user with administrative access on the EPMM interface. This could be achieved via credential stuffing, phishing, or brute force if proper MFA and access controls are not in place.
2. Exploitation: Once authenticated, the attacker sends a maliciously crafted request to a vulnerable endpoint. Due to the lack of strict input validation, the application interprets this payload as a command rather than data, executing code on the underlying host operating system.

Because EPMM is typically deployed as a Linux-based appliance, this RCE effectively provides the attacker with root or high-privileged access to the management server. This grants total control over the mobile device fleet, including the ability to push malicious profiles, wipe devices, or exfiltrate sensitive corporate data managed by the MDM.

Exploitation Status

Confirmed Active Exploitation: Ivanti has confirmed that this vulnerability is being exploited in limited, targeted attacks in the wild. This moves the timeline from "patch management" to "Incident Response." If your environment runs a vulnerable version, you should assume the possibility of compromise rather than just theoretical risk.

Detection & Response

The following detection rules and queries are designed to identify the exploitation of CVE-2026-6973. Since EPMM is a Linux appliance, detection relies heavily on process monitoring (via AuditD/EDR) and log aggregation.

SIGMA Rules

These rules target the behavioral outcome of the exploit: the web server service spawning a system shell, which is anomalous behavior for a standard MDM web interface.

---
title: Ivanti EPMM Web Server Spawning Shell
id: 8f4a2b1c-5d6e-4f3a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects potential exploitation of CVE-2026-6973 where the Ivanti EPMM web service (Tomcat/Java) spawns a shell process.
references:
  - https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.6973
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/java'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
    CommandLine|contains:
      - 'sh'
      - 'curl'
      - 'wget'
  condition: selection
falsepositives:
  - Legitimate administrative debugging by vendor support
level: high
---
title: Ivanti EPMM Suspicious Outbound Network Connection
id: 3c7d8e9f-0a1b-2c3d-4e5f-6a7b8c9d0e1f
status: experimental
description: Detects non-standard outbound connections from the EPMM appliance, potentially indicating C2 or data exfiltration post-exploitation.
references:
  - https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.exfiltration
  - attack.t1071.001
  - cve.2026.6973
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    InitImage|endswith: '/java'
    DestinationPort|notin:
      - 443
      - 80
      - 8443
      - 8080
  condition: selection
falsepositives:
  - Legitimate API calls to known internal infrastructure
level: medium

KQL (Microsoft Sentinel)

If you are forwarding Linux Syslog or CommonSecurityLog data from the EPMM appliance to Sentinel, use this query to hunt for suspicious parent-child process relationships indicative of RCE.

// Hunt for EPMM Exploitation Indicators via Syslog/AuditD
Syslog
| where ProcessName != "" and ProcessName has_any ("bash", "sh", "dash", "python", "perl")
// Identify the parent process in the syslog message format (often parsed in SyslogMessage)
| extend ParentProcess = extract(@'(PPid=([\d]+)|ParentProcess=([\w/.-]+))', 1, SyslogMessage)
// Filter for parent processes associated with Ivanti EPMM (Java/Tomcat)
| where SyslogMessage has "java" 
| project TimeGenerated, Computer, ProcessName, SyslogMessage, ParentProcess
| where ProcessName !contains "grep" 
| summarize count() by ProcessName, Computer, bin(TimeGenerated, 5m)
| where count_ > 0

Velociraptor VQL

Deploy this hunt artifact on your EPMM servers (if you have the Velociraptor agent installed) to scan for processes spawned by the Java web container.

-- Hunt for Web Server Spawning Shells (CVE-2026-6973)
SELECT Pid, Ppid, Name, Exe, Username, CommandLine, StartTime
FROM pslist()
WHERE Name =~ '^(bash|sh|dash|zsh|python|perl)$'
  // Filter for processes parented by Java (the EPMM backend)
  AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'java')

Remediation Script (Bash)

Use this script on your EPMM appliance to verify the current version and check vulnerability status against the patched releases.

#!/bin/bash
# Ivanti EPMM CVE-2026-6973 Vulnerability Checker
# Checks if the running version is patched against CVE-2026-6973

echo "Checking Ivanti EPMM version for CVE-2026-6973..."

# Attempt to retrieve version from typical MI configuration location
# Note: Path may vary slightly based on install specifics, /etc/mi/mi_config is standard for MobileIron/EPMM
if [ -f /etc/mi/mi_config ]; then
    CURRENT_VERSION=$(grep -m1 'version' /etc/mi/mi_config | awk -F'"' '{print $2}')
else
    echo "[ERROR] Configuration file not found at /etc/mi/mi_config. Please verify manually."
    exit 1
fi

echo "Current EPMM Version Detected: $CURRENT_VERSION"

# Define patched versions (must be greater than or equal to these)
PATCH_1="12.6.1.1"
PATCH_2="12.7.0.1"
PATCH_3="12.8.0.1"

# Function to check version logic (simplified sorting)
check_vulnerable() {
    local current=$1
    # If version is explicitly one of the patched ones, it is safe
    if [ "$current" == "$PATCH_1" ] || [ "$current" == "$PATCH_2" ] || [ "$current" == "$PATCH_3" ]; then
        return 1 # Not vulnerable
    fi

    # Basic string comparison for 12.x.x.x format
    # Assumes format A.B.C.D
    if [ "$current" < "$PATCH_1" ]; then
        return 0 # Vulnerable
    elif [ "$current" > "$PATCH_1" ] && [ "$current" < "$PATCH_2" ]; then
        return 0 # Vulnerable
    elif [ "$current" > "$PATCH_2" ] && [ "$current" < "$PATCH_3" ]; then
        return 0 # Vulnerable
    fi

    return 1 # Safe (e.g., 12.9.x.x)
}

if check_vulnerable "$CURRENT_VERSION"; then
    echo "[ALERT] SYSTEM IS VULNERABLE to CVE-2026-6973."
    echo "Action Required: Upgrade to $PATCH_1, $PATCH_2, or $PATCH_3 immediately."
    exit 1
else
    echo "[INFO] System version meets patched baseline (or is newer)."
    echo "Please verify official vendor advisory to confirm specific build nuances."
    exit 0
fi

Remediation

Immediate Actions

1. Patch Immediately: Apply the updates released by Ivanti. You must upgrade to one of the following fixed versions to mitigate the vulnerability:

   • 12.6.1.1
   • 12.7.0.1
   • 12.8.0.1

2. Access Control & Credential Rotation: Since this vulnerability requires an authenticated administrative user to trigger the RCE, assume that if you were vulnerable, your admin credentials may be compromised.

   • Force a password reset for all EPMM administrative accounts.
   • Enforce Multi-Factor Authentication (MFA) on the admin console immediately if not already active.
   • Review audit logs for unusual admin login times or locations.

3. Network Segmentation: If patching is delayed, strictly limit access to the EPMM management interface (ports 443, 8443) to specific IP ranges or management VLANs. Do not expose the management interface directly to the public internet.

Vendor Advisory

Refer to the official Ivanti security advisory for detailed download links and checksums:

• Ivanti Security Advisory: Link to Ivanti Portal
• CISA KEV Catalog: Check if this vulnerability has been added to the Known Exploited Vulnerabilities Catalog for specific deadlines.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub