In CISA KEV9.8 CriticalCWE-94
CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
IvantiEndpoint Manager Mobile (EPMM)
Status
- Exploited in the wild
- In CISA KEV since 29 Jan
- Vendor fix available
Federal deadlineSun 1 Feb, 23:59 UTC
Passed 265 days ago
CISA KEV · added 29 Jan
Exploit probabilityEPSSchecked 25 Oct
99%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 13 articles · 7 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 10 Feb · 08:50 UTC | The Hacker News | Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data |
| Wed 11 Feb · 01:15 UTC | SecurityOnline | Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMM |
| Wed 11 Feb · 12:40 UTC | SecurityWeek | Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025 |
| Thu 12 Feb · 08:35 UTC | The Hacker News | 83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure |
| Thu 12 Feb · 23:01 UTC | Dark Reading | Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — Again |
| Tue 17 Feb · 20:55 UTC | Unit 42 | Critical Vulnerabilities in Ivanti EPMM Exploited |
| Thu 19 Feb · 12:25 UTC | SecurityWeek | Ivanti Exploitation Surges as Zero-Day Attacks Traced Back to July 2025 |
| Fri 8 May · 05:50 UTC | SecurityWeek | Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacks |
- Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacksSecurityWeek · mentions it in passing
- Ivanti Exploitation Surges as Zero-Day Attacks Traced Back to July 2025SecurityWeek
- Critical Vulnerabilities in Ivanti EPMM ExploitedUnit 42
- Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — AgainDark Reading
- 83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting InfrastructureThe Hacker News
- Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025SecurityWeek · mentions it in passing
- Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMMSecurityOnline
- Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact DataThe Hacker News
- U.S. CISA adds a flaw in Ivanti EPMM to its Known Exploited Vulnerabilities catalogSecurity Affairs
- Ivanti Patches Exploited EPMM Zero-DaysSecurityWeek
- CVE-2026-1281 & CVE-2026-1340: Ivanti EPMM Zero-Day Vulnerabilities Enable Unauthenticated RCESOCRadar
- Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates ReleasedThe Hacker News
- Exploited in the Wild: Critical Ivanti EPMM RCE Flaws (CVSS 9.8) Under AttackSecurityOnline · first in our coverage