83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-24799 | Unauthenticated SQL Injection in GLPI Inventory Endpoint GLPI, a widely used open-source IT asset and service management platform, contains an unauthenticated SQL injection flaw (CWE-89) in its inventory endpoint. An attacker can trigger it by sending specially crafted, unauthenticated requests to that endpoint, causing attacker-controlled input to be executed within SQL queries. Successful exploitation could allow reading or modifying the GLPI database, exposing sensitive IT asset and configuration data and potentially further access, consistent with the critical 9.8 CVSS score (high confidentiality, integrity and availability impact). Any GLPI deployment running a version earlier than 10.0.18 is affected, particularly instances whose inventory endpoint is reachable by untrusted clients. A public proof-of-concept exists and the flaw is not yet in CISA's KEV, but EPSS assigns an 86.3% probability of exploitation within 30 days (100th percentile), indicating elevated exploitation risk. Do: Upgrade to GLPI 10.0.18 or later immediately, prioritizing instances whose inventory endpoint is exposed to untrusted networks or the internet. If patching must be delayed, restrict access to the inventory endpoint (e.g., limit to known agent source IPs or internal networks) and review logs for anomalous or unauthenticated inventory requests. Note that exploitation requires no authentication or user interaction, so do not rely on access controls alone. | 9.8 | 86% | PoC |
| large≈tens of thousands of GLPI installations, with thousands of instances plausibly internet-exposed | |
| CVE-2026-1340 +1 in the same advisory: …1281 | Unauthenticated Code Injection RCE in Ivanti Endpoint Manager Mobile CVE-2026-1340 is a code injection flaw (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM), Ivanti's enterprise mobile device management platform, that permits unauthenticated remote code execution. Because the flaw is network-reachable and requires no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), a remote attacker can send a crafted request to a vulnerable EPMM server and execute arbitrary code, with high impact to confidentiality, integrity, and availability. Any organization operating an affected EPMM server is affected, especially those exposing the management or device-enrollment interface to the internet. The flaw was added to CISA's KEV catalog on 2026-04-08 with an 86.2% probability of exploitation within 30 days; news reporting describes active zero-day attacks against EPMM (alongside related CVE-2026-6973), including a confirmed Dutch government incident exposing employee contact data, while ransomware use remains unconfirmed. A large share of observed exploit traffic has been traced to a single IP address on bulletproof hosting infrastructure. Do: Apply Ivanti's patched EPMM release per the vendor advisory immediately and verify the fix on any internet-facing EPMM portal; US federal agencies must follow BOD 22-01 mitigation deadlines. Until patched, restrict EPMM portal access to trusted networks/VPNs and review access logs for suspicious requests or unrecognized source IPs, noting that much exploit activity has originated from a single bulletproof-hosting IP. | 9.8 | 86% | KEV |
| large≈ tens of thousands of EPMM server deployments, a large share of them internet-exposed | |
| CVE-2026-21962 | Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (components: the plug-in for Apache HTTP Server and the plug-in for IIS), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can trivially exploit it, and the scope-change designation means a successful attack can significantly impact additional products beyond the plug-in itself. The attacker gains unauthorized access to critical data (potentially all accessible data) as well as the ability to create, delete, or modify critical data, reflected in the maximum CVSS 10.0 score with high confidentiality and integrity impacts and no availability impact. Organizations running the affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for Oracle HTTP Server and the Apache plug-in, and 12.2.1.4.0 only for the IIS plug-in - especially those with internet-facing Apache/IIS/OHS front ends proxying WebLogic applications, are exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-24, and EPSS assigns a 42% probability of exploitation within 30 days, though no public proof-of-concept is known. Do: Apply the fixes from Oracle's January 2026 quarterly update (advisory AV26-042) or later for Oracle HTTP Server and the WebLogic Server Proxy Plug-in on all affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 (IIS plug-in affected at 12.2.1.4.0 only). Prioritize internet-facing OHS, Apache and IIS front ends per CISA BOD 26-04 and the KEV required actions, and where patching is delayed, restrict HTTP access to trusted networks and review logs for signs of unauthorized data access or modification. | 10.0 | 42% | KEV |
| large~10,000-100,000 internet-exposed Oracle HTTP Server / WebLogic proxy front ends | |
| CVE-2026-24061 | Argument Injection Authentication Bypass in GNU Inetutils telnetd GNU Inetutils telnetd, in all versions through 2.7, contains an argument injection flaw (CWE-88) in its handling of the USER environment variable: a remote, unauthenticated attacker who supplies a crafted value of "-f root" for USER during a telnet session can bypass authentication entirely. An attacker gains command execution as root on the target host with no credentials, yielding full compromise (CVSS 3.1: 9.8). Any Linux system or distribution shipping the affected telnetd is exposed — most notably Debian through its inetutils package — and reporting indicates the flaw has existed for roughly 11 years and is currently unpatched in all versions. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, carries a 98% EPSS score (100th percentile), public PoC exploits exist, and GreyNoise has documented observed attacker activity against telnetd. Do: Inventory Linux hosts (especially Debian) for GNU Inetutils telnetd listening on port 23 and disable the telnet service or restrict it with firewall rules, since the flaw is reported unpatched in all versions through 2.7 and no fixed version is confirmed in the available data. As a CISA KEV entry (added 2026-01-26), apply vendor mitigations per BOD 22-01 guidance or discontinue use if mitigations are unavailable. Watch telnetd logs for sessions setting USER to values like "-f root", and monitor GNU/Debian channels for a patched release to deploy as soon as it appears. | 9.8 | 98% | KEV PoC ×4 |
| large≈10,000–100,000 internet-exposed telnetd instances (a subset of the several hundred thousand telnet port 23 devices observed in public internet scans); total… |
Full article704 words · extracted from thehackernews.com · click to collapse
A significant chunk of the exploitation attempts targeting a newly disclosed security flaw in Ivanti Endpoint Manager Mobile (EPMM) can be traced back to a single IP address on bulletproof hosting infrastructure offered by PROSPERO.
Threat intelligence firm GreyNoise said it recorded 417 exploitation sessions from 8 unique source IP addresses between February 1 and 9, 2026. An estimated 346 exploitation sessions have originated from 193.24.123[.]42, accounting for 83% of all attempts.
The malicious activity is designed to exploit CVE-2026-1281 (CVSS scores: 9.8), one of the two critical security vulnerabilities in EPMM, along with CVE-2026-1340 that could be exploited by an attacker to achieve unauthenticated remote code execution. Late last month, Ivanti acknowledged it's aware of a "very limited number of customers" who were impacted following the zero-day exploitation of the issues.
Since then, multiple European agencies, including the Netherlands' Dutch Data Protection Authority (AP), Council for the Judiciary, the European Commission, and Finland's Valtori, have disclosed that they were targeted by unknown threat actors using the vulnerabilities.
Further analysis has revealed that the same host has been simultaneously exploiting three other CVEs across unrelated software -
- CVE-2026-21962 (Oracle WebLogic) - 2,902 sessions
- CVE-2026-24061 (GNU InetUtils telnetd) - 497 sessions
- CVE-2025-24799 (GLPI) - 200 sessions
"The IP rotates through 300+ unique user agent strings spanning Chrome, Firefox, Safari, and multiple operating system variants," GreyNoise said. "This fingerprint diversity, combined with concurrent exploitation of four unrelated software products, is consistent with automated tooling."
It's worth noting that PROSPERO is assessed to be linked to another autonomous system called Proton66, which has a history of distributing desktop and Android malware like GootLoader, Matanbuchus, SpyNote, Coper (aka Octo), and SocGholish.
GreyNoise also pointed out that 85% of the exploitation sessions beaconed home via the domain name system (DNS) to confirm "this target is exploitable" without deploying any malware or exfiltrating data.
The disclosure comes days after Defused Cyber reported a "sleeper shell" campaign that deployed a dormant in-memory Java class loader to compromised EPMM instances at the path "/mifs/403.jsp." The cybersecurity company said the activity is indicative of initial access broker tradecraft, where threat actors establish a foothold to sell or hand off access later for financial gain.
"That pattern is significant," it noted. "OAST [out-of-band application security testing] callbacks indicate the campaign is cataloging which targets are vulnerable rather than deploying payloads immediately. This is consistent with initial access operations that verify exploitability first and deploy follow-on tooling later."
Ivanti EPMM users are recommended to apply the patches, audit internet-facing Mobile Device Management (MDM) infrastructure, review DNS logs for OAST-pattern callbacks, and monitor for the /mifs/403.jsp path on EPMM instances, and block PROSPERO's autonomous system (AS200593) at the network perimeter level.
"EPMM compromise provides access to device management infrastructure for entire organizations, creating a lateral movement platform that bypasses traditional network segmentation," GreyNoise said. "Organizations with internet-facing MDM, VPN concentrators, or other remote access infrastructure should operate under the assumption that critical vulnerabilities face exploitation within hours of disclosure."
Update
Following the publication of the story, an Ivanti spokesperson shared the below statement with The Hacker News -
Ivanti's recommendation remains the same: customers who have not yet patched should do so immediately, and then review their appliance for any signs of exploitation that may have occurred prior to patching. Applying the patch is the most effective way to prevent exploitation, regardless of how IoCs change over time, especially once a POC is available. The patch requires no downtime and takes only seconds to apply.
Ivanti has provided customers with high-fidelity indicators of compromise, technical analysis at disclosure, and an Exploitation Detection script developed with NCSC-NL, and continues to support customers as we respond to this threat.
The GreyNoise research team told The Hacker News via email that CVE-2026-1281 and CVE-2026-1340 were disclosed by Ivanti as related code injection vulnerabilities in different EPMM components, and that it's tracking both the CVEs under a single deletion tag (CVE-2026-1281). "Given the relationship between the two, organizations should treat both CVEs as equally urgent," it added.
(The story was updated after publication to include responses from Ivanti and GreyNoise.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/02/83-of-ivanti-epmm-exploits-linked-to.html