Ivanti Endpoint Manager Mobile contains an improper input validation flaw that allows a remotely authenticated administrator to achieve remote code execution. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated that federal civilian agencies complete remediation by May 10, 2026. Organizations that have not yet applied Ivanti's patch or applied compensating controls are now past the federal deadline. The mandatory deadline signals active exploitation in the wild. Administrators of Ivanti EPMM instances — particularly those exposed to the internet or accessible from less-trusted administrative networks — should treat patching as urgent. Delayed remediation leaves mobile device management infrastructure, which typically holds broad device enrollment credentials, at direct risk of compromise.