CVE-2026-1281

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) CWE-94

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

82%

Riskier than 100% of all CVEs · checked 2026-09-08

Exploitation

Confirmed in the wild

KEV since 2026-01-29

Remediation

Patch available

Federal deadline 2026-02-01

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-02-01.

NVD entry Vendor patch PoC / advisory CISA KEV

13 articles across 7 outlets · first covered May 8, 2026 · latest May 8, 2026

Coverage timeline

Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacks
www.securityweek.com · May 8, 2026
Ivanti Exploitation Surges as Zero-Day Attacks Traced Back to July 2025
www.securityweek.com · Feb 19, 2026
Critical Vulnerabilities in Ivanti EPMM Exploited
unit42.paloaltonetworks.com · Feb 17, 2026
Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — Again
www.darkreading.com · Feb 12, 2026
83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure
thehackernews.com · Feb 12, 2026
Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025
www.securityweek.com · Feb 11, 2026
Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMM
securityonline.info · Feb 11, 2026
Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data
thehackernews.com · Feb 10, 2026
U.S. CISA adds a flaw in Ivanti EPMM to its Known Exploited Vulnerabilities catalog
securityaffairs.com · Jan 30, 2026
Ivanti Patches Exploited EPMM Zero-Days
www.securityweek.com · Jan 30, 2026
CVE-2026-1281 & CVE-2026-1340: Ivanti EPMM Zero-Day Vulnerabilities Enable Unauthenticated RCE
socradar.io · Jan 30, 2026
Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates Released
thehackernews.com · Jan 30, 2026
Exploited in the Wild: Critical Ivanti EPMM RCE Flaws (CVSS 9.8) Under Attack
securityonline.info · Jan 30, 2026

Related CVEs — Ivanti

CVE-2026-12650 CVE-2026-12744 CVE-2026-12745 CVE-2026-12647 CVE-2026-12645 CVE-2026-12646 CVE-2026-83527 CVE-2026-18851