2026-001: Critical vulnerabilities in Ivanti EPMM
Ivanti EPMM has two critical CVSS 9.8 flaws allowing unauthenticated remote code execution; limited exploitation has already been observed.
On 29 January 2026, Ivanti patched CVE-2026-1281 and CVE-2026-1340, two code injection vulnerabilities (both CVSS 9.8) in Endpoint Manager Mobile that allow unauthenticated remote code execution. CERT-EU reports one of the flaws was exploited in a limited number of cases. Affected versions include EPMM 12.5.1.0, 12.6.1.0 and 12.7.0.0 and prior; the permanent fix is planned for release 12.8.0.0 in Q1 2026.
- Two CVSS 9.8 code injection flaws enable unauthenticated RCE on EPMM
- One vulnerability exploited in a limited number of cases
- Hotfix RPM does not survive version upgrades and must be reapplied
- Permanent fix expected in EPMM 12.8.0.0 in Q1 2026
- Products
- Ivanti Endpoint Manager Mobile
- Organizations
- IvantiCERT-EUEuropean Union Agency for Cybersecurity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-1281+1 related CVE | Unauthenticated RCE in Ivanti Endpoint Manager Mobile (EPMM) | 9.8 | 99% | KEVPoC | KEV |
From the original article
1 min read at cert.europa.eu
On 29 January 2026, Ivanti released a security advisory addressing two critical vulnerabilities in their EPMM products. An attacker could exploit those flaws to achieve unauthenticated remote code execution on the vulnerable device. One of these vulnerabilities have been exploited in a limited number of cases.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.