🔴 CVE-2026-6973

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-05-07

Added to CISA KEV: 2026-05-07 0 DAY BETWEEN CVE AND KEV

🌐 Internet Exposure (Shodan): 661 internet-facing instances →
Query: http.title:"MobileIron"   View on Shodan ↗
MobileIron was the previous name for Ivanti EPMM before the Ivanti acquisition, and many deployments may still show the legacy branding in web interfaces
Checked: 2026-06-04

🎯 Recommendations:

• ⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
• IMMEDIATE: Update to patched versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 depending on your current branch
• Audit administrative accounts with access to EPMM console for unauthorized access or suspicious activity
• Review EPMM server logs for evidence of command injection attempts or unusual administrative activity
• Consider implementing additional network segmentation or WAF protection for EPMM servers
• HIGH PRIORITY patching due to internet-facing deployment pattern and RCE impact

🔍 Web Intelligence (Kagi · 2026-05-07)

Sources

1. Known Exploited Vulnerabilities Catalog - CISA

   For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catal…

2. BOD 22-01: Reducing the Significant Risk of Known Exploited... | CISA

   CISA adds the reported actively exploited vulnerabilities to the KEV catalog, provided they meet BOD 22-01 requirements. Exploited vulnerabilities CISA uncovers through incident response efforts are also added to the KEV catalog. CISA analysts perform daily open-source searches for vulnerabilities.H…

3. The Kev Catalog

   A detailed list of Known Exploited Vulnerabilities. Available as CSV and JSON files.

4. Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA

   Learn about the importance of CISA's Known Exploited Vulnerability (KEV) catalog and how to use it to help build a collective resilience across the cybersecurity community.

5. CISA Adds Six Known Exploited Vulnerabilities to Catalog

   CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.