HIGHVulnerability
Verified
Global

CISA KEV: Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

Analysis

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution. Added to CISA Known Exploited Vulnerabilities catalog on 2026-05-07. Remediation due: 2026-05-10.

Indicators of Compromise (1)

CVE (1)
CVE-2026-6973
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on May 7, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-102361 — mall4j through 4.0 contains a missing authentication vulnerability in the PUT /u...

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

CVE-2026-102361
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-101264 — A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unk...

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101264
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-101263 — A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some...

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101263
NIST NVD