Ivanti EPMM code-injection flaws CVE-2026-1281 and CVE-2026-1340 exploited; permanent fixes available
Attackers exploited two flaws in Ivanti EPMM, the server organisations use to manage phones, to run code without signing in. Permanent fixes arrived in 12.8.0.0. Ask IT to update the server and investigate any compromise before it was patched.
If your family's business or employer uses Ivanti EPMM, ask its IT team to install the latest supported release containing the fixes first shipped in 12.8.0.0 and investigate signs of earlier compromise. The affected software is the organisation's management server; updating your phone does not fix that server.
What’s happening
Two critical code-injection flaws let remote attackers run code without signing in to Ivanti Endpoint Manager Mobile (EPMM), an on-premises system organisations use to manage mobile devices. A compromised server can expose staff identities and device information and give attackers a foothold in the organisation's network. Ivanti disclosed the issues on 29 January after some customers had been compromised and supplied emergency updates. Rapid7 initially distinguished confirmed exploitation of CVE-2026-1281 from uncertainty about CVE-2026-1340; CISA subsequently listed the latter as exploited on 8 April. Unit 42 reported widespread attacks involving malware and backdoors, including against Australian organisations. EPMM 12.8.0.0, released on 18 March, permanently fixes both vulnerabilities. Ivanti Neurons for MDM, Endpoint Manager and Sentry are unaffected. As at 3 November, fixes are available, but patching alone does not establish that an already compromised server is clean.
- What
- Flaw
- Affects
- Ivanti Endpoint Manager Mobile (EPMM), on-premises
- Affected
- Ivanti EPMM 12.5.0.x, 12.6.0.x and 12.7.0.x without the applicable RPM 12.x.0.x security update
Ivanti EPMM 12.5.1.0 and 12.6.1.0 without the applicable RPM 12.x.1.x security update - Fixed in
- Ivanti EPMM 12.8.0.0
RPM 12.x.0.x security update for the affected 12.x.0.x branches
RPM 12.x.1.x security update for the affected 12.x.1.x branches - Since
- 29 Jan 2026
- Closed
- 9 Apr 2026
Timeline
- Update
Ivanti reiterated that customers should upgrade to EPMM 12.8, which provides the permanent fixes and additional security hardening. Researchers contacted by Cybersecurity Dive reported no recent change in attacks explaining the timing of CISA's April listing.
- CISA added
CISA added CVE-2026-1340 to its Known Exploited Vulnerabilities catalogue, confirming its use in attacks. CVE-2026-1281 had been listed since 29 January.
- New fixFixed
Ivanti released EPMM 12.8.0.0. Its cumulative release notes explicitly list CVE-2026-1281 and CVE-2026-1340 as fixed in that version.
- Wider attacks
Unit 42's updated investigation described widespread, mostly automated exploitation of the two flaws, including malware and backdoors. Observed targets included organisations in Australia, Canada, Germany and the United States.
- New fixPartly fixed
Rapid7 documented Ivanti's emergency RPM updates for both flaws across the affected 12.5, 12.6 and 12.7 versions. Its initial assessment confirmed pre-disclosure exploitation of CVE-2026-1281 but said this was not yet clear for CVE-2026-1340.
- Made public
Ivanti disclosed vulnerabilities affecting its on-premises EPMM product and said a small number of customers had already been compromised. Its cloud-based Neurons for MDM, Endpoint Manager and Sentry products were not affected.
Sources
- January 2026 EPMM Security UpdateIvanti · 29 Jan 2026
- EPMM cumulative release notes: resolved issuesIvanti · 13 Aug 2026
- EPMM and Connector 12.0.0.0–12.10.0.0 Release NotesIvanti · 13 Aug 2026
- Critical Ivanti Endpoint Manager Mobile zero-day exploited in the wildRapid7 · 30 Jan 2026
- Critical Vulnerabilities in Ivanti EPMM ExploitedPalo Alto Networks Unit 42 · 1 Apr 2026
- Ivanti security advisory (AV26-068) – Update 2Canadian Centre for Cyber Security · 8 Apr 2026
- CISA adds second critical flaw in Ivanti EPMM to exploited vulnerabilities catalogCybersecurity Dive · 9 Apr 2026