CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Ivanti Endpoint Manager Mobile (EPMM)

product · product:ivanti-endpoint-manager-mobile-epmm

Coverage
2
first 2026-05-08 → last 2026-09-30
Latest activity
2026-09-11
Ivanti discloses two unauthenticated pre-auth RCEs in Neurons for ITSM, crediting LLM-assisted review with…
Peak priority
high
2 high
Targets
public-sector
sectors: public-sector, technology · regions: europe
Sources cited
15
11 hosts

Action items (2)

Do-now tasks recorded on the entries about Ivanti Endpoint Manager Mobile (EPMM), newest first. Check the date before acting on an older one.

  • Patch Ivanti Neurons for ITSM to the September 2026 release now; CVE-2026-12744 and CVE-2026-12745 are unauthenticated, no-interaction deserialization flaws reaching full remote code execution on any internet-exposed instance.
    2026-09-11CVE-2026-12744 +9
  • If any on-premises EPMM appliance was hit in the January CVE-2026-1281/1340 wave and its local admin passwords were not reset, reset every EPMM admin credential now and review admin API activity since then, because the exploited CVE-2026-6973 needs only an admin login.
    2026-05-08CVE-2026-6973 +4

Defender insights

What each entry about Ivanti Endpoint Manager Mobile (EPMM) tells a defender to do, newest first.

2026-09-11HIGHIvanti discloses two unauthenticated pre-auth RCEs in Neurons for ITSM, crediting LLM-assisted review with surfacing several of the disclosed flaws

2026-05-08HIGHexploitedIvanti's exploited EPMM flaw needs an admin login, so admin passwords never rotated after January's EPMM zero-days are the real exposure

Exposure · detection

Story timeline

  1. 2026-09-11Ivanti September 2026 Security Update, ten CVEs across Neurons for ITSM, Sentry and EPMM, two unauthenticated CVSS 9.8 deserialization RCEs
    trending-vulnerabilitiesIvanti discloses two unauthenticated pre-auth RCEs in Neurons for ITSM, crediting LLM-assisted review with surfacing several of the disclosed flaws
  2. 2026-05-08CVE-2026-6973: Ivanti EPMM admin-authenticated RCE exploited in limited attacks, fixed with four further EPMM flaws including unauthenticated Sentry certificate issuance (CVE-2026-5787)
    trending-vulnerabilitiesIvanti's exploited EPMM flaw needs an admin login, so admin passwords never rotated after January's EPMM zero-days are the real exposure

Hunting pivots

CVEs (exploited first)
CVE-2026-6973CVE-2026-12645CVE-2026-12646CVE-2026-12647CVE-2026-12648CVE-2026-12650CVE-2026-12651CVE-2026-12744CVE-2026-12745CVE-2026-18851CVE-2026-5786CVE-2026-5787CVE-2026-5788CVE-2026-7821CVE-2026-83527
Releases covered
Ivanti Endpoint Manager Mobile (EPMM) ×2
Tags
auth-bypass ×2patch-available ×2rce ×2vulnerabilities ×2actively-exploitedcisa-kevpriv-esc
ATT&CK techniques (3 across 4 tactics)

3 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts
  • Privilege EscalationExploitation for Privilege Escalation · Valid Accounts
  • StealthValid Accounts

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-08/cve-2026-5787-cve-2026-6973-ivanti-epmm-pre-auth-certificate · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-11/ivanti-september-2026-security-update-itsm-sentry-epmm · 2026-05-08/cve-2026-5787-cve-2026-6973-ivanti-epmm-pre-auth-certificate · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-08/cve-2026-5787-cve-2026-6973-ivanti-epmm-pre-auth-certificate · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-11/ivanti-september-2026-security-update-itsm-sentry-epmm · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-08/cve-2026-5787-cve-2026-6973-ivanti-epmm-pre-auth-certificate · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-08/cve-2026-5787-cve-2026-6973-ivanti-epmm-pre-auth-certificate · ATT&CK page ↗

Entries about Ivanti Endpoint Manager Mobile (EPMM) (2)

2026-09-11 · view entry permalink →

HIGHCVE-2026-12744 +9NATOA2

Ivanti September 2026 Security Update, ten CVEs across Neurons for ITSM, Sentry and EPMM, two unauthenticated CVSS 9.8 deserialization RCEs

Ivanti's 2026-09-08 security update discloses ten CVEs across three product lines, none reported exploited (Ivanti, 2026-09-08). Neurons for ITSM carries the most severe pair: CVE-2026-12744 and CVE-2026-12745, both CVSS 9.8 unauthenticated deserialization-of-untrusted-data flaws reaching remote code execution on the server with no credentials and no user interaction (SecurityWeek, 2026-09-09). Six further ITSM flaws need low-privilege authentication first: three missing-authorization bugs (CVE-2026-12645/12646/12647, CVSS 9.9) and three further deserialization paths (CVE-2026-12650 at 9.9, CVE-2026-12651/12648 at 8.8) all escalate an authenticated low-privilege session to code execution or full administrative control (SecurityWeek, 2026-09-09; Cyber Security News, 2026-09-08). Ivanti Sentry carries CVE-2026-83527 (CVSS 8.1), a high-attack-complexity authentication bypass that lets a remote unauthenticated attacker obtain administrative access to the Sentry platform (NCSC-NL NCSC-2026-0357, 2026-09-09). Ivanti Endpoint Manager Mobile carries CVE-2026-18851 (CVSS 8.8), a missing-authorization flaw letting an authenticated low-privilege user escalate to full administrator (NCSC-NL NCSC-2026-0359, 2026-09-09).

The September patch covers on-premises Neurons for ITSM versions 2025.2, 2025.3, 2025.4 and 2026.1; the fixes are also included in the 2026.2 release line, scheduled for 2026-09-21 (SecurityWeek, 2026-09-09). NCSC-NL's advisory additionally lists the Cloud/SaaS edition of Neurons for ITSM as affected, without stating a separate cloud remediation date (NCSC-NL NCSC-2026-0358, 2026-09-09). Sentry is fixed in R10.8.2/R10.7.3/R10.6.4, EPMM in 12.10.0.0/12.9.0.2/12.8.0.4 (SecurityWeek, 2026-09-09). Ivanti states it has no evidence of exploitation for any of the ten and that no other Ivanti product is affected (Ivanti, 2026-09-08). Notably, Ivanti states it has integrated multiple advanced large language models into its product-security and engineering workflows to identify vulnerabilities "especially those that are difficult to identify with traditional tooling, such as SAST and DAST," and credits this with surfacing some of the flaws disclosed today (Ivanti, 2026-09-08); a rare instance of AI-assisted vulnerability discovery being credited directly in a formal vendor advisory (Cyber Security News, 2026-09-08).

We have no evidence of these vulnerabilities being exploited in the wild.

These vulnerabilities do not impact any other Ivanti solutions.

Ivanti

these ITSM flaws were uncovered through the company's use of advanced large language models integrated into its product security and engineering workflows, marking a rare instance of AI-assisted vulnerability discovery being credited in a formal advisory.

Cyber Security News 2026-09-08

According to Ivanti's advisory, only CVE-2026-12744 and CVE-2026-12745 can be exploited without authentication.

SecurityWeek 2026-09-09
vulnerability11 Sep 04:35Zmulti-sourceOpen finding →
Sources: Ivanti (vendor blog) · NCSC-NL (advisory NCSC-2026-0358, Neurons for ITSM) · NCSC-NL (advisory NCSC-2026-0357, Sentry) · NCSC-NL (advisory NCSC-2026-0359, EPMM) · SecurityWeek · Cyber Security News

2026-05-08 · view entry permalink →

HIGHCVE-2026-6973 +4exploitedupdatedNATOA1

CVE-2026-6973: Ivanti EPMM admin-authenticated RCE exploited in limited attacks, fixed with four further EPMM flaws including unauthenticated Sentry certificate issuance (CVE-2026-5787)

Ivanti's May 2026 update for on-premises Endpoint Manager Mobile (EPMM) fixes five vulnerabilities. Ivanti states: "At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation", and "We are not aware of any customers being exploited by the other vulnerabilities disclosed today"; Ivanti Neurons for MDM, Ivanti EPM and Ivanti Sentry are not affected (Ivanti, 2026-05-07). CVE-2026-6973 (CVSS 7.2) is improper input validation that lets "a remotely authenticated user with administrative access to achieve remote code execution", fixed in 12.6.1.1, 12.7.0.1 and 12.8.0.1 (The Hacker News, 2026-05-07), and CISA added it to its Known Exploited Vulnerabilities catalog the same day (CISA KEV catalog, 2026-05-07).

The admin-login precondition is less reassuring than it looks. CERT-FR recalls that its guidance for January's exploited EPMM flaws CVE-2026-1281 and CVE-2026-1340 was to reset every local EPMM account password, and warns that where this was not done, attackers can reuse administrator passwords obtained then to exploit CVE-2026-6973 (CERT-FR, 2026-05-07). Ivanti makes the same link, saying customers who rotated credentials after January face a significantly reduced risk (BleepingComputer, 2026-05-07).

The four companion flaws are not reported exploited: CVE-2026-5786 (CVSS 8.8) lets an authenticated attacker gain administrative access, CVE-2026-5787 (CVSS 8.9) lets an unauthenticated attacker impersonate registered Sentry hosts and obtain valid CA-signed client certificates, CVE-2026-5788 (CVSS 7.0) lets an unauthenticated attacker invoke arbitrary methods, and CVE-2026-7821 (CVSS 7.4) lets an unauthenticated attacker enroll a device from a restricted set, exposing information about the appliance (The Hacker News, 2026-05-07). Shadowserver counted over 850 exposed EPMM instances, 508 of them in Europe and 182 in North America (BleepingComputer, 2026-05-07). No one has attributed the exploitation; SecurityWeek notes only that Chinese actors are often believed to be behind Ivanti zero-days (SecurityWeek, 2026-05-08).

At the time of disclosure, we are aware of very limited exploitation of CVE-2026-6973, which requires admin authentication for successful exploitation.

We are not aware of any customers being exploited by the other vulnerabilities disclosed today.

Ivanti 2026-05-07
Updaterun 2026-05-09-migratedregionssectorssourcestagsbody

CERT-FR (CERT-FR, 2026-05-07), Germany's BSI (BSI, 2026-05-07) and NCSC-CH (NCSC-CH Cyber Security Hub, 2026-05-08) published advisories on the May 2026 EPMM update. CERT-FR highlights the reuse of administrator passwords stolen in January as the way attackers reach CVE-2026-6973 (CERT-FR, 2026-05-07), and BSI notes that the required admin credentials may have leaked in the January attacks via CVE-2026-1281 and CVE-2026-1340 (BSI, 2026-05-07).

Updaterun 2026-05-10-001cvesevidencesourcestagsbody

Shadowserver counted over 850 internet-exposed EPMM instances, 508 of them in Europe and 182 in North America (BleepingComputer, 2026-05-07). Ivanti has confirmed exploitation of CVE-2026-6973 against "a very limited number of customers" without naming them, and SecurityWeek notes that Chinese actors are often believed to be behind Ivanti zero-days, without attributing this wave (SecurityWeek, 2026-05-08). The same May update fixes CVE-2026-5786, CVE-2026-5787, CVE-2026-5788 and CVE-2026-7821, none reported exploited (Ivanti, 2026-05-07).

Correctionrun 2026-09-30T0639Z-audittitleheadlinesummaryevent_datetagstechniquesaffected_productscvessourcesevidencesourcing_noteclassificationactionsbody

The earlier text described an exploited pre-authentication chain from CVE-2026-5787 into CVE-2026-6973, marked all five CVEs exploited and KEV-listed, and named four European public bodies as victims of this wave. Ivanti reports very limited exploitation of CVE-2026-6973 alone, which requires admin authentication, and no exploitation of the other four (Ivanti, 2026-05-07); only CVE-2026-6973 is in KEV (CISA KEV catalog, 2026-05-07); and no cited source names victims of the May wave. The path CERT-FR describes is reuse of administrator passwords stolen in January (CERT-FR, 2026-05-07). CVE-2026-7821 affects only deployments that use and have configured Apple Device Enrollment (BleepingComputer, 2026-05-07).

vulnerability08 May 05:00Zmulti-sourceOpen finding →
Sources: Ivanti · The Hacker News · CERT-FR · BleepingComputer · SecurityWeek · CISA KEV catalog · NCSC-CH Cyber Security Hub · BSI · Canadian Centre for Cyber Security

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns2

Source distribution

  • advisories.ncsc.nl3 (20%)
  • ivanti.com2 (13%)
  • securityweek.com2 (13%)
  • bleepingcomputer.com1 (7%)
  • bsi.bund.de1 (7%)
  • cert.ssi.gouv.fr1 (7%)
  • cisa.gov1 (7%)
  • cyber.gc.ca1 (7%)
  • other3 (20%)
All cited sources (15)