CVE-2026-1281

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection flaw (CWE-94) that permits unauthenticated remote code execution: an attacker who can reach the EPMM server over the network can send crafted requests that execute arbitrary code without credentials or user interaction. Successful exploitation yields control of the MDM server, exposing directory/contact data, device inventory, and the ability to push commands or profiles to enrolled corporate mobile devices. Any organization running an affected EPMM deployment is in scope, with internet-facing instances at greatest risk; the available data does not specify affected version ranges, so operators should consult Ivanti's advisory. Exploitation is confirmed in the wild — the flaw was added to CISA's KEV on 2026-01-29 and carries an 81.8% EPSS — and press reporting describes EPMM under active zero-day attack, apparently alongside a second critical EPMM vulnerability (CVE-2026-6973), including incidents disclosed by Dutch government and EU bodies.

What to do: Patch EPMM per Ivanti's security advisory immediately — CISA's KEV required action is to apply vendor mitigations by the listed deadline, follow BOD 22-01 guidance for cloud services, or discontinue use — and note that the provided data does not include patched version numbers, so rely on the vendor advisory for exact targets. Until patched, remove direct internet exposure from EPMM (restrict to VPN/management networks) and hunt for compromise, checking logs for activity from bulletproof-hosting infrastructure, since public reporting says the large majority of observed EPMM exploits trace to a single IP there. Also verify whether the separately reported EPMM zero-day (CVE-2026-6973) affects your deployment, as attackers appear to be chaining the two flaws.