On May 7, CISA added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog and gave federal agencies until May 10 to patch. The vulnerability is an authenticated remote code execution flaw in Ivanti Endpoint Manager Mobile (EPMM) on-prem, scoring CVSS 7.2, and Ivanti has confirmed limited in-the-wild exploitation. According to The Hacker News, Shadowserver was tracking more than 800 internet-exposed EPMM instances when the advisory dropped.
If you are running EPMM, you already know what to do: upgrade to 12.6.1.1, 12.7.0.1, or 12.8.0.1, audit admin accounts, and check your logs. This post is not really for you. It is for everyone else, because the lesson here is not about Ivanti.
The pattern keeps repeating
Over the last two years, a remarkably consistent picture has emerged in CISA advisories and vendor incident reports: when attackers want a fast path to many endpoints, they go for the endpoint management server. We have written about why CISA called Intune the crown jewels after the Stryker attack, and about Multi Admin Approval as a control for that risk. The Ivanti story is the same shape on a different platform.
An EMM or MDM platform is, by design, a one-to-many control plane. From a single console you can push configuration, install software, run scripts, wipe devices, change compliance state. That is what makes it useful to you. It is also what makes it valuable to anyone who can reach it.
Why CVE-2026-6973 is more dangerous than its CVSS suggests
The technical detail of the Ivanti bug is that it requires authentication and administrative privileges on the EPMM admin console. A naive reading is “an admin can get RCE on the box they already control — so what?” That reading misses two operational realities.
First, EMM admin consoles are usually reachable from far more places than your other admin tooling. They are often internet-facing by design, because they need to talk to enrolled mobile devices that are not on the corporate network. Qualys reporting on the exploitation confirms internet exposure is part of the attack surface here.
Second, “admin” on an EMM platform often means several things glued together: a long-running technical account whose password lives in a runbook, an account that signs into the console without an MFA prompt because it is a service identity, an integration account used by a deployment pipeline. A flaw that turns “any admin” into “RCE on the EMM server” is functionally a flaw that turns “any leaked or stale admin secret” into “code execution that can reach every enrolled endpoint.”
That is also why the broader Ivanti advisory matters: CVE-2026-6973 was disclosed alongside four other flaws in the same release. Patching just the KEV one and walking away is a near miss.
Seven questions to ask about your endpoint management stack this week
Whatever platform you run — Intune, EPMM, Workspace ONE, Kandji, Jamf, your home-grown PowerShell-and-prayer setup — the Ivanti incident is a useful prompt. Set aside an hour and walk through these:
- Who can log in as an admin to the management console today? Pull the actual list. Compare it to your most recent leavers report. Names that should not be there are a finding.
- Which of those admin accounts have MFA enforced? All of them, or only the ones tied to a real human? Service accounts and break-glass identities are the ones that quietly skip MFA.
- Is the admin console reachable from the public internet? If yes, is that necessary, or a historical artefact of how the platform was first deployed? IP allow-lists and Conditional Access policies are the obvious first lever.
- Do you have a separate, monitored alert for new admin role assignments? Most platforms can emit this. Most organisations do not subscribe to it. The Ivanti pattern relies on having admin in the first place.
- What is your patch SLA for the management platform itself? Many teams have a tight SLA for endpoints and a much looser one for the servers that manage them. Reverse that order. The console is the higher-value target.
- Have you tested your recovery path if the management platform itself is compromised? If the answer to “how do we push a remediation to 5,000 endpoints” depends on the same console an attacker is sitting in, you have a problem.
- What does the integration account do? The pipeline or service account that connects your EMM to ticketing, identity, or asset systems is almost always over-privileged. Ivanti-shaped bugs make those accounts the soft entry point.
What to do now
If you run Ivanti EPMM, patch this week and audit admin logins for anything outside business hours or expected geographies. If you do not, take the next thirty minutes and do three things. Pull the admin list for your management platform and compare it against your active staff. Confirm MFA is enforced on every admin account, including service identities. And put your management console on the same patch SLA you give your domain controllers — because for an attacker, that is now how it functions.
The Ivanti story will fade from the news cycle within a week. The pattern will not. Your endpoint management platform is part of your control plane, and treating it like just another piece of infrastructure is the gap attackers keep finding.
