CVE-2026-1281

The flaw is based on the ability to inject and execute arbitrary code (CWE-94) in the Ivanti EPMM component. The attacker does not need any credentials or user interaction — network access to the vulnerable system is sufficient. The attack vector is network-based, with low complexity, making this vulnerability exceptionally easy to exploit in automated attacks.

Successful exploitation of the vulnerability gives the attacker full control over the system — it is possible to steal sensitive data, modify the configuration of mobile devices managed by EPMM, and conduct lateral movement within the organization's infrastructure.

Apply patches available from the vendor immediately according to the references (https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340). Due to active exploitation in production environments, it is recommended to restrict access to EPMM management interfaces exclusively to trusted IP addresses and increase anomaly monitoring until updates are applied.

Ivanti Endpoint Manager Mobile (EPMM) — versions specified in the vendor references (Ivanti advisory: CVE-2026-1281 / CVE-2026-1340)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.