An Ivanti flaw in its Endpoint Manager (EPM) has been exploited despite being identified and patched in May.