Ivanti EPMM Zero-Day Exploitation Exposed Sensitive Government and Enterprise Data

Ivanti warned that two critical zero-day flaws in Endpoint Manager Mobile (EPMM) — CVE-2026-1281 and CVE-2026-1340 — were being actively exploited, and subsequent reporting described rapid mass exploitation after proof-of-concept code became public. The attacks hit internet-facing EPMM systems used to manage mobile devices, with incident responders documenting a fully automated intrusion chain that successfully exfiltrated sensitive EPMM data and leveraged lesser-known product behaviors alongside an open-source offensive framework. Germany's BSI also issued an alert on active attacks, underscoring the broad operational impact of the campaign.

The exploitation wave affected both opportunistic victims and targeted organizations, including governments. Dutch authorities disclosed that attackers had maintained access to the Dutch Custodial Institutions Agency's EPMM server for about five months, exposing employee names, email addresses, phone numbers, and location data, with officials warning of elevated blackmail and extortion risks. Ivanti's earlier handling of EPMM flaws, including CVE-2023-35082, had already shown that internet-exposed deployments could enable unauthorized access to personally identifiable information, but the company separately clarified that a later May 2026 advisory for Endpoint Manager (EPM) — covering CVE-2026-8109, CVE-2026-8110, and CVE-2026-8111 — involved a different product and was not tied to the EPMM zero-day exploitation.