In CISA KEV9.8 CriticalCWE-94
CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
IvantiEndpoint Manager Mobile (EPMM)
Status
- Exploited in the wild
- In CISA KEV since 8 Apr
- Vendor fix available
Federal deadlineSat 11 Apr, 23:59 UTC
Passed 196 days ago
CISA KEV · added 8 Apr
Exploit probabilityEPSSchecked 25 Oct
99%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 15 articles · 8 outlets
See the full timelineShow as table
- Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacksSecurityWeek · mentions it in passing
- CISA adds critical Ivanti EPMM flaw to KEV after PoC releaseSecurity Affairs · mentions it in passing
- CISA Flags CVE-2026-1340 in Ivanti EPMM, Orders Rapid PatchCISA · official notice
- CISA warns of Ivanti EPMM flaw enabling remote code executionCISA · official notice
- Ivanti Exploitation Surges as Zero-Day Attacks Traced Back to July 2025SecurityWeek · mentions it in passing
- Critical Vulnerabilities in Ivanti EPMM ExploitedUnit 42 · mentions it in passing
- Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy — AgainDark Reading · mentions it in passing
- 83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting InfrastructureThe Hacker News · mentions it in passing
- Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025SecurityWeek · mentions it in passing
- Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMMSecurityOnline · mentions it in passing
- Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact DataThe Hacker News · mentions it in passing
- Ivanti Patches Exploited EPMM Zero-DaysSecurityWeek · mentions it in passing
- CVE-2026-1281 & CVE-2026-1340: Ivanti EPMM Zero-Day Vulnerabilities Enable Unauthenticated RCESOCRadar · mentions it in passing
- Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates ReleasedThe Hacker News · mentions it in passing
- Exploited in the Wild: Critical Ivanti EPMM RCE Flaws (CVSS 9.8) Under AttackSecurityOnline · first in our coverage · mentions it in passing