The U.S. cybersecurity agency CISA issued an urgent order for federal agencies to patch a critical vulnerability in Ivanti products that is already being actively exploited as a zero-day.
The flaw, identified as CVE-2026-6973, affects Ivanti Endpoint Manager Mobile (EPMM), a platform used for managing enterprise mobile devices. According to Ivanti, the problem allows remote code execution to attackers who already possess administrative privileges over the target system.
What is happeningThe CISA directive requires U.S. federal agencies to secure their systems within only four days, reflecting the severity of the risk and the possibility of ongoing attacks.
Ivanti confirmed that the vulnerability is being exploited “to a limited extent” in real attacks and published security updates to correct the problem in several product branches.
The corrected versions are:
- 12.6.1.1
- 12.7.0.1
- 12.8.0.1
The company also recommended reviewing all accounts with administrative privileges and rotating credentials as an additional measure of protection.
Affected productsThe issue affects only on-premise installations of Ivanti EPMM. According to the company, other products are not affected, including:
- Ivanti Neurons for MDM
- Ivanti EPM
- Ivanti Sentry
The Shadowserver Foundation organization detected over 800 exposed instances of Ivanti EPMM accessible from the Internet. However, there is still no public information on how many have already been patched.
Ivanti continues under pressure for zero-day vulnerabilitiesThis new incident adds to a long series of security issues that have affected Ivanti in recent years. As recently as January, the company corrected two other critical vulnerabilities in EPMM that were also exploited as zero-days.
Furthermore, CISA has cataloged numerous Ivanti vulnerabilities as “actively exploited,” several of which have been used by ransomware groups and state-sponsored espionage actors.
Recommendations for administratorsExperts recommend acting immediately:
- Apply the patches published by Ivanti.
- Review suspicious administrative access.
- Rotate privileged credentials.
- Limit public exposure of EPMM servers.
- Monitor for unusual activity and authentication logs.
The speed of the order issued by CISA demonstrates that the authorities consider this vulnerability an active and priority threat to government and corporate infrastructures.