Active Exploitation of Ivanti EPMM Zero-Day RCE Vulnerabilities

Ivanti Endpoint Manager Mobile (EPMM) is being actively exploited via two critical, unauthenticated remote code execution vulnerabilities, CVE-2026-1281 and CVE-2026-1340 (both reported as CVSS 9.8). Reporting describes attackers achieving full control of exposed EPMM/MDM infrastructure, including establishing reverse shells, deploying web shells, performing reconnaissance, and downloading additional malware; activity has been observed across multiple countries and sectors (including government, healthcare, manufacturing, and technology). CISA added CVE-2026-1281 to the Known Exploited Vulnerabilities (KEV) Catalog, and defenders are urged to apply Ivanti’s available fixes/updates per the vendor advisory.

Telemetry and threat-intel observations indicate broad internet exposure and automation in exploitation. Unit 42 reported visibility into 4,400+ EPMM instances, and noted threat actors shifting from initial exploitation toward dormant backdoors intended to preserve access even after patching. GreyNoise data highlighted that a large share of observed exploitation traffic (reported as 83%) originated from a single IP, 193.24.123.42, associated with “bulletproof” hosting, with attackers rotating user-agent strings consistent with mass scanning/exploitation; the same infrastructure was also linked to attempts against other products (e.g., Oracle WebLogic, telnetd, and GLPI).