83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-24799 | Unauthenticated SQL Injection in GLPI Inventory Endpoint | 9.8 | 87% | PoC | |
CVE-2026-1281+1 related CVE | Unauthenticated RCE in Ivanti Endpoint Manager Mobile (EPMM) | 9.8 | 99% | KEVPoC | KEV |
| CVE-2026-21962 | Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in | 10.0 | 73% | KEV | KEV |
| CVE-2026-24061 | Argument Injection Authentication Bypass in GNU Inetutils telnetd | 9.8 | 99% | KEVPoC ×8 | KEV |
From the original article
3 min read at thehackernews.com
A significant chunk of the exploitation attempts targeting a newly disclosed security flaw in Ivanti Endpoint Manager Mobile (EPMM) can be traced back to a single IP address on bulletproof hosting infrastructure offered by PROSPERO. Threat intelligence firm GreyNoise said it recorded 417 exploitation sessions from 8 unique source IP addresses between February 1 and 9, 2026.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.