Critical Ivanti EPMM RCE Flaws Exploited to Compromise On-Premises Servers
Ivanti warned that its on-premises Endpoint Manager Mobile (EPMM) product contains two critical vulnerabilities, CVE-2026-1281 and CVE-2026-1340, that can let an unauthenticated remote attacker execute arbitrary commands or code over the network. The flaws affect exposed EPMM servers and create a path to full server compromise and possible lateral movement into internal environments. Ivanti said its cloud offerings, including Ivanti Neurons for MDM, and the separate Ivanti Endpoint Manager (EPM) product are not affected, and it released patches, incident-response guidance, and a detection tool to help customers assess exposure and compromise.
Follow-up advisories said the vulnerabilities are being actively exploited, prompting defenders to inspect EPMM systems for anomalous logs, unauthorized administrator-account changes, and suspicious device-configuration modifications. A later update citing Germany's BSI said exploitation may date back to summer 2025, expanding the scope of required forensic review beyond recent activity. Public reporting from security researchers, including Palo Alto Networks Unit 42 and vulnerability tracking sources, reinforced that the issue is an unauthenticated remote code execution risk requiring immediate patching and retrospective compromise hunting on affected on-premises deployments.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
8 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reports critical Ivanti EPMM vulnerabilities are being exploited
Palo Alto Networks Unit 42 published reporting that the critical Ivanti EPMM vulnerabilities were under active exploitation. This reinforced public awareness of the in-the-wild abuse of the flaws.
German BSI report links Ivanti EPMM exploitation to 2025 activity
A February update cited a German BSI report saying exploitation had already taken place as early as summer 2025. Based on that finding, defenders were urged to review historical evidence of compromise rather than only recent activity.
Ivanti publishes and updates compromise assessment tooling
Ivanti published incident investigation guidance and a detection tool to help customers assess whether EPMM servers had been compromised. The tool was later updated to improve compromise assessment support.
Active exploitation warning added for Ivanti EPMM flaws
An update to the security notice stated that attackers were actively exploiting CVE-2026-1281 and CVE-2026-1340 in the wild. Defenders were advised to inspect EPMM devices for signs of compromise, including anomalous logs and unauthorized changes to admin accounts or device configuration.
watchTowr publishes PoC exploit for Ivanti EPMM flaws
On January 30, 2026, watchTowr Labs released a technical report with proof-of-concept exploit code for CVE-2026-1281 and CVE-2026-1340. The publication increased urgency for defenders to patch Ivanti EPMM systems and review logs for signs of compromise.
Traficom warns organizations to patch vulnerable Ivanti EPMM systems
Finland's Traficom issued a security notice warning that the Ivanti EPMM vulnerabilities were critical and required immediate patching. The notice clarified that Ivanti cloud products such as Ivanti Neurons for MDM and the separate Ivanti Endpoint Manager product were not affected.
Ivanti discloses critical EPMM flaws and issues patch guidance
Ivanti disclosed critical vulnerabilities affecting on-premises Endpoint Manager Mobile, including CVE-2026-1281 and CVE-2026-1340, and published guidance to patch affected systems. The flaws could allow unauthenticated remote command or code execution against the EPMM server.
Ivanti EPMM vulnerabilities were exploited as early as summer 2025
A later-cited German BSI report said exploitation of the Ivanti Endpoint Manager Mobile flaws had already occurred by summer 2025. This indicates the vulnerabilities were being abused well before public disclosure.
Sources
15 references tracked. Mallory keeps watching after this page renders.
Critical Vulnerabilities in Ivanti EPMM Exploited
unit42.paloaltonetworks.com
Open sourceBSI - Bundesamt für Sicherheit in der Informationstechnik - Version 1.3: Ivanti EPMM - Aktive Angriffe über Zero-Day Schwachstellen beobachtet
bsi.bund.de
Open sourceCasus: kwetsbaarheden Ivanti EPMM systemen | NCSC
ncsc.nl
Open sourceUpdate: geüpdatet scanscript beschikbaar voor kwetsbaarheid in Ivanti Endpoint Manager Mobile | NCSC
ncsc.nl
Open sourceIvanti EPMM Unauthenticated RCE (CVE-2026-1281) - TheHackerWire
thehackerwire.com
Open sourceIvanti EMM Unauthenticated RCE (CVE-2026-1340) - TheHackerWire
thehackerwire.com
Open sourceIvanti Endpoint Manager Mobile Exploit Chain Exploited in the Wild | Rapid7 Blog
rapid7.com
Open sourceIvanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution
cloud.projectdiscovery.io
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti EPMM Zero-Day CVE-2026-6973 Exploited via Stolen Admin Credentials
Ivanti disclosed active exploitation of **CVE-2026-6973**, a high-severity improper input validation flaw in on-premises **Endpoint Manager Mobile (EPMM)** that allows remote code execution when used with administrator authentication. The company said exploitation has been limited to a small number of customers and assessed with high confidence that attackers are using administrator credentials stolen during earlier January attacks involving **CVE-2026-1281** and **CVE-2026-1340**. Affected versions are EPMM releases prior to **12.6.1.1**, **12.7.0.1**, and **12.8.0.1**; Ivanti said **Neurons for MDM**, **EPM**, **Sentry**, and other products are not affected. Ivanti also patched four additional high-severity EPMM flaws—**CVE-2026-5786**, **CVE-2026-5787**, **CVE-2026-5788**, and **CVE-2026-7821**—covering certificate validation and access-control weaknesses that could enable host impersonation, unauthorized access, arbitrary method invocation, and unauthorized device enrollment, though the vendor said it has no evidence those bugs were exploited. **CISA** added CVE-2026-6973 to its **Known Exploited Vulnerabilities** catalog and ordered U.S. federal agencies to remediate by **May 10, 2026**, while national cyber agencies in Canada and Finland urged immediate patching. Ivanti advised customers to rotate EPMM administrator credentials, review privileged accounts, hunt for compromise artifacts such as webshells and reverse shells, and reduce public exposure of management interfaces; internet scans have identified more than **850** exposed EPMM instances, mainly in Europe and North America.
May 10, 2026
Ivanti EPMM Zero-Day RCE via CVE-2026-1281 and CVE-2026-1340
Ivanti disclosed two **critical, actively exploited** Ivanti Endpoint Manager Mobile (*EPMM*) vulnerabilities—**CVE-2026-1281** and **CVE-2026-1340**—described as unauthenticated code-injection issues enabling **remote code execution (RCE)** with a **CVSS 9.8** rating. Ivanti reported exploitation affecting a *very limited number* of customers at disclosure and warned that successful compromise of the EPMM appliance could expose sensitive data stored in the platform (e.g., admin/user details and managed-device metadata such as phone numbers, IPs, installed apps, and identifiers like IMEI/MAC), and potentially allow attackers to change device configurations via the API or web console, including authentication-related settings. Guidance from national cybersecurity authorities emphasized that EPMM’s role in mobile device management can make it a pivot point into internal environments, potentially enabling lateral movement if the appliance is compromised. Affected versions include EPMM **12.5.x, 12.6.x, and 12.7.x** (including **12.5.1.0** and **12.6.1.0** and earlier as specified), while Ivanti’s cloud offerings (e.g., *Ivanti Neurons for MDM*) and *Ivanti Endpoint Manager (EPM)* are not impacted. Ivanti provided interim mitigations/hotfixes (RPM-based) with the caveat that hotfixes may need reapplication after upgrades, and indicated a permanent fix is expected in **EPMM 12.8.0.0**; organizations were advised to patch immediately and review appliances for compromise indicators such as anomalous logs and unexpected admin/configuration changes.
May 7, 2026
Ivanti EPMM Zero-Day Exploitation Exposed Sensitive Government and Enterprise Data
Ivanti warned that two critical zero-day flaws in **Endpoint Manager Mobile (EPMM)** — `CVE-2026-1281` and `CVE-2026-1340` — were being actively exploited, and subsequent reporting described rapid mass exploitation after proof-of-concept code became public. The attacks hit internet-facing EPMM systems used to manage mobile devices, with incident responders documenting a fully automated intrusion chain that successfully exfiltrated sensitive EPMM data and leveraged lesser-known product behaviors alongside an open-source offensive framework. Germany's BSI also issued an alert on active attacks, underscoring the broad operational impact of the campaign. The exploitation wave affected both opportunistic victims and targeted organizations, including governments. Dutch authorities disclosed that attackers had maintained access to the Dutch Custodial Institutions Agency's EPMM server for about five months, exposing employee names, email addresses, phone numbers, and location data, with officials warning of elevated blackmail and extortion risks. Ivanti's earlier handling of **EPMM** flaws, including `CVE-2023-35082`, had already shown that internet-exposed deployments could enable unauthorized access to personally identifiable information, but the company separately clarified that a later May 2026 advisory for **Endpoint Manager (EPM)** — covering `CVE-2026-8109`, `CVE-2026-8110`, and `CVE-2026-8111` — involved a different product and was not tied to the EPMM zero-day exploitation.
May 25, 2026