Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-1281

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

9.8
CVSS 3.1
3
stories
JAN 29
added to KEV
Severity
9.8 Critical · vendor score
Vendor
Ivanti
Product
Endpoint Manager Mobile (EPMM)
Published
Jan 29, 2026
Added to KEV
Jan 29, 2026
KEV deadline
Feb 1, 2026
Ransomware use
Unknown
Weakness
CWE-94
Part of Ivanti EPMM Zero-Days →

What it is

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 3 stories

Newest first ↑
  1. VulnerabilitiesIvanti Discloses Exploited Critical EPMM FlawsThe vulnerabilities (CVE-2026-1281 and CVE-2026-1340) could lead to unauthenticated remote code execution if successfully exploited.DECIPHER · 2 MIN
  2. VulnerabilitiesResearchers Warn of ‘Widespread’ Ivanti EPMM ExploitationExploitation of CVE-2026-1281 and CVE-2026-1340 is “widespread and mostly automated,” according to Unit 42 researchers.DECIPHER · 2 MIN
  3. VulnerabilitiesIvanti Warns of Exploited EPMM Flaw CVE-2026-6973The vulnerability (CVE-2026-6973) exists in Ivanti Endpoint Manager Mobile (EPMM) is being exploited by threat actors.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Fixforums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340