CISA added Ivanti Endpoint Manager Mobile CVE-2026-6973 to its Known Exploited Vulnerabilities catalog on May 7, with a federal patch deadline of May 10. Even if you do not run EPMM, here is what the incident says about your own endpoint management stack – and seven questions to ask this week.