Ivanti

Ivanti is a US vendor of endpoint management, Mobile Device Management and remote access tools, headquartered in South Jordan, Utah. Its customers include enterprises and governments worldwide, among them critical infrastructure operators, NHS trusts and European government departments.

Since 2024 its products have been a leading target for state-linked hackers. Chinese APT groups and Iranian actors used Ivanti Connect Secure flaws in mass exploitation campaigns that reached critical infrastructure and defence targets, and CISA went as FAR as recommending temporary disconnection of specific Ivanti products. In March 2026 CISA added CVE-2026-1603, an authentication bypass in Ivanti Endpoint Manager, to its Known Exploited Vulnerabilities catalogue.

Ivanti's mobile device manager, Endpoint Manager Mobile (EPMM), carries the heaviest record. On 7 May 2026 CISA listed CVE-2026-6973, a Remote Code Execution flaw open to an authenticated administrator (CVSS 7.2), with a 10 May federal Deadline. It was the product's fourth KEV zero-day since 2023. Ivanti confirmed limited exploitation and said customers WHO rotated credentials after its January 2026 zero-days faced reduced risk. The Norwegian Security and Service Organisation had lost data to an earlier version of the same flaw. A compromised EPMM server reaches every device it manages.