{"id":"ivanti-epmm-code-injection-attacks-jan-2026","category":"patch","status":"closed","title":"Ivanti EPMM code-injection flaws CVE-2026-1281 and CVE-2026-1340 exploited; permanent fixes available","tldr":"Attackers exploited two flaws in Ivanti EPMM, the server organisations use to manage phones, to run code without signing in. Permanent fixes arrived in 12.8.0.0. Ask IT to update the server and investigate any compromise before it was patched.","summary":"Two critical code-injection flaws let remote attackers run code without signing in to Ivanti Endpoint Manager Mobile (EPMM), an on-premises system organisations use to manage mobile devices. A compromised server can expose staff identities and device information and give attackers a foothold in the organisation's network. Ivanti disclosed the issues on 29 January after some customers had been compromised and supplied emergency updates. Rapid7 initially distinguished confirmed exploitation of CVE-2026-1281 from uncertainty about CVE-2026-1340; CISA subsequently listed the latter as exploited on 8 April. Unit 42 reported widespread attacks involving malware and backdoors, including against Australian organisations. EPMM 12.8.0.0, released on 18 March, permanently fixes both vulnerabilities. Ivanti Neurons for MDM, Endpoint Manager and Sentry are unaffected. As at 3 November, fixes are available, but patching alone does not establish that an already compromised server is clean.","action":"If your family's business or employer uses Ivanti EPMM, ask its IT team to install the latest supported release containing the fixes first shipped in 12.8.0.0 and investigate signs of earlier compromise. The affected software is the organisation's management server; updating your phone does not fix that server.","product":"Ivanti Endpoint Manager Mobile (EPMM), on-premises","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-1281","CVE-2026-1340"],"tags":["ivanti","epmm","mobile-device-management","code-injection","zero-day","actively-exploited"],"affected":["Ivanti EPMM 12.5.0.x, 12.6.0.x and 12.7.0.x without the applicable RPM 12.x.0.x security update","Ivanti EPMM 12.5.1.0 and 12.6.1.0 without the applicable RPM 12.x.1.x security update"],"fixed":["Ivanti EPMM 12.8.0.0","RPM 12.x.0.x security update for the affected 12.x.0.x branches","RPM 12.x.1.x security update for the affected 12.x.1.x branches"],"matches":[],"sources":[{"kind":"advisory","title":"January 2026 EPMM Security Update","url":"https://www.ivanti.com/blog/january-2026-epmm-security-update","by":"Ivanti","date":"2026-01-29"},{"kind":"advisory","title":"EPMM cumulative release notes: resolved issues","url":"https://help.ivanti.com/mi/help/en_us/core/12.x/rn/CoreConnectorReleaseNotes/Resolved_issues.htm","by":"Ivanti","date":"2026-08-13"},{"kind":"advisory","title":"EPMM and Connector 12.0.0.0–12.10.0.0 Release Notes","url":"https://help.ivanti.com/mi/help/en_us/core/12.x/rn/CoreConnectorReleaseNotes/IvantiEPMM_rn_12.x.pdf","by":"Ivanti","date":"2026-08-13"},{"kind":"research","title":"Critical Ivanti Endpoint Manager Mobile zero-day exploited in the wild","url":"https://www.rapid7.com/blog/post/etr-critical-ivanti-endpoint-manager-mobile-epmm-zero-day-exploited-in-the-wild-eitw-cve-2026-1281-1340/","by":"Rapid7","date":"2026-01-30"},{"kind":"research","title":"Critical Vulnerabilities in Ivanti EPMM Exploited","url":"https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/","by":"Palo Alto Networks Unit 42","date":"2026-04-01"},{"kind":"advisory","title":"Ivanti security advisory (AV26-068) – Update 2","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-068","by":"Canadian Centre for Cyber Security","date":"2026-04-08"},{"kind":"news","title":"CISA adds second critical flaw in Ivanti EPMM to exploited vulnerabilities catalog","url":"https://www.cybersecuritydive.com/news/cisa-second-critical-flaw-ivanti-epmm-exploited/817080/","by":"Cybersecurity Dive","date":"2026-04-09"}],"started":"2026-01-29","closed":"2026-04-09","created":"2026-11-03T22:28:28.362Z","updated":"2026-11-03T22:28:28.362Z","cve_notes":[{"cve":"CVE-2026-1281","name":"Code injection in EPMM's in-house app distribution","what":"A code-injection flaw in EPMM's in-house application distribution handling lets a remote attacker run code on the management server without signing in.","severity":"critical","cvss":9.8},{"cve":"CVE-2026-1340","name":"Code injection in EPMM's Android file transfer","what":"A code-injection flaw in EPMM's Android file-transfer handling lets a remote attacker run code on the management server without signing in.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-04-09","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Ivanti reiterated that customers should upgrade to EPMM 12.8, which provides the permanent fixes and additional security hardening. Researchers contacted by Cybersecurity Dive reported no recent change in attacks explaining the timing of CISA's April listing.","url":"https://www.cybersecuritydive.com/news/cisa-second-critical-flaw-ivanti-epmm-exploited/817080/","by":"Cybersecurity Dive","patch":null},{"at":"2026-04-08","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2026-1340 to its Known Exploited Vulnerabilities catalogue, confirming its use in attacks. CVE-2026-1281 had been listed since 29 January.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-068","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-03-18","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Ivanti released EPMM 12.8.0.0. Its cumulative release notes explicitly list CVE-2026-1281 and CVE-2026-1340 as fixed in that version.","url":"https://help.ivanti.com/mi/help/en_us/core/12.x/rn/CoreConnectorReleaseNotes/Resolved_issues.htm","by":"Ivanti","patch":"patched"},{"at":"2026-02-23","added":"2026-11-03T22:23:31.291Z","kind":"wider-attacks","text":"Unit 42's updated investigation described widespread, mostly automated exploitation of the two flaws, including malware and backdoors. Observed targets included organisations in Australia, Canada, Germany and the United States.","url":"https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/","by":"Palo Alto Networks Unit 42","patch":null},{"at":"2026-01-30","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Rapid7 documented Ivanti's emergency RPM updates for both flaws across the affected 12.5, 12.6 and 12.7 versions. Its initial assessment confirmed pre-disclosure exploitation of CVE-2026-1281 but said this was not yet clear for CVE-2026-1340.","url":"https://www.rapid7.com/blog/post/etr-critical-ivanti-endpoint-manager-mobile-epmm-zero-day-exploited-in-the-wild-eitw-cve-2026-1281-1340/","by":"Rapid7","patch":"partial"},{"at":"2026-01-29","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Ivanti disclosed vulnerabilities affecting its on-premises EPMM product and said a small number of customers had already been compromised. Its cloud-based Neurons for MDM, Endpoint Manager and Sentry products were not affected.","url":"https://www.ivanti.com/blog/january-2026-epmm-security-update","by":"Ivanti","patch":null}],"url":"https://hard.fyi/live/ivanti-epmm-code-injection-attacks-jan-2026/","json":"https://hard.fyi/api/live?id=ivanti-epmm-code-injection-attacks-jan-2026"}