SecurityWeekIonut Arghire
Ivanti Patches Exploited EPMM Zero-Days
Ivanti has issued emergency patches for two critical-severity EPMM vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340, which are described as code injection flaws that unauthenticated attackers could exploit to achieve remote code execution. According to Ivanti, the flaws affect in-house application distribution and Android file transfer configuration features in Endpoint Manager Mobile and have been exploited in the wild as zero-days.
The company says that all EPMM versions up to 12.5.0.0, 12.6.0.0, 12.7.0.0, 12.5.1.0, and 12.6.1.0 are affected, and it has released RPM patches for 12.x, with guidance to reapply the RPM script after any update. Ivanti encourages customers to upgrade to version 12.8.0.0 once released in Q1 2026, after which reapplication of the RPM script should not be required.
CISA has added CVE-2026-1281 to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch by 1 February, with the advisory noting limited exploitation and outlining potential attacker techniques such as web shells and reverse shells.
Story timeline CVE-2026-1281
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 30 Jan · 08:41 UTC | SecurityWeek | Ivanti Patches Exploited EPMM Zero-Days (this article) |
| Tue 10 Feb · 08:50 UTC | The Hacker News | Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data |
| Wed 11 Feb · 01:15 UTC | SecurityOnline | Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMM |
| Wed 11 Feb · 12:40 UTC | SecurityWeek | Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025 |
| Thu 12 Feb · 08:35 UTC | The Hacker News | 83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure |
| Thu 12 Feb · 23:01 UTC | Dark Reading | Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — Again |
| Tue 17 Feb · 20:55 UTC | Unit 42 | Critical Vulnerabilities in Ivanti EPMM Exploited |
| Thu 19 Feb · 12:25 UTC | SecurityWeek | Ivanti Exploitation Surges as Zero-Day Attacks Traced Back to July 2025 |
| Fri 8 May · 05:50 UTC | SecurityWeek | Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacks |