Critical Ivanti EPMM CVE-2023-35078 Lets Attackers Run Remote Code

Key Takeaways

• A critical vulnerability, CVE-2026-6973, has been discovered in Ivanti Endpoint Manager Mobile (EPMM).
• The flaw allows authenticated attackers to execute arbitrary remote code by injecting malicious Apache configuration directives.
• Affected versions include 12.9.0, 12.8.0.2, 12.7.0.1, and all earlier releases.
• Ivanti has released patches for this vulnerability, and immediate upgrades are strongly recommended.

Critical Remote Code Execution Flaw Discovered in Ivanti EPMM

A severe security vulnerability has been identified within Ivanti Endpoint Manager Mobile (EPMM) that could enable authenticated attackers to achieve remote code execution. Designated as CVE-2026-6973, this flaw permits the injection of malicious Apache configuration directives, posing a significant risk to organizations utilizing the platform.

The vulnerability carries a CVSS score of 7.2 and is categorized as a configuration control weakness (CWE-15). It impacts several versions of Ivanti EPMM, specifically versions 12.9.0, 12.8.0.2, 12.7.0.1, and all preceding releases.

According to the official security advisory from Ivanti, the root cause of this vulnerability lies in the improper handling of configuration inputs within the EPMM application. This oversight allows an attacker, once authenticated and possessing sufficient privileges, to inject arbitrary Apache directives directly into the server’s configuration.

Such manipulation can fundamentally alter how the web server processes incoming requests, ultimately creating an avenue for remote code execution on the compromised system.

Understanding the Ivanti EPMM Vulnerability

The exploitation of CVE-2026-6973 does not require any user interaction and can be initiated remotely over a network. This makes the vulnerability particularly hazardous in enterprise environments where EPMM is extensively deployed for managing mobile devices and enforcing critical security policies.

Successful exploitation could allow threat actors to deploy web shells, execute arbitrary scripts, or establish a deeper foothold within the target’s internal network infrastructure. The CVSS vector for CVE-2026-6973 highlights that despite requiring high privileges for execution, the attack complexity is low, and the potential impact on confidentiality, integrity, and availability is severe.

Ivanti has proactively released patches to address this critical flaw. The corrected versions are 12.9.0.1, 12.8.0.3, and 12.7.0.2. Organizations currently operating any of the vulnerable versions are urged to upgrade their systems without delay.

Procrastinating on these patches could leave systems exposed to potential exploitation, especially if attackers have already managed to gain initial authenticated access through methods like phishing, credential theft, or other initial access vectors. At the time of disclosure, Ivanti reported no evidence of active exploitation of this vulnerability in the wild.

Furthermore, no specific indicators of compromise (IOCs) have been publicly released, reinforcing proactive patching as the primary and most effective mitigation strategy.

What You Should Do

• Apply Patches Immediately: Upgrade Ivanti EPMM installations to versions 12.9.0.1, 12.8.0.3, 12.7.0.2, or newer as soon as possible.
• Review Access Controls: Scrutinize and tighten access controls for Ivanti EPMM, particularly for privileged accounts, given that the vulnerability requires authentication.
• Audit Privileged Accounts: Regularly audit activities associated with privileged accounts to detect any suspicious behavior that could indicate compromise.
• Monitor for Anomalies: Implement monitoring for unusual configuration changes or unexpected Apache server behavior, which could signal attempted exploitation.
• Educate Users: Reinforce security awareness training to prevent initial access vectors like phishing that could lead to authenticated access.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.