Ivanti EPMM Zero-Days

At the end of January 2026, Ivanti disclosed two critical flaws in Endpoint Manager Mobile, CVE-2026-1281 and CVE-2026-1340, that attackers were already exploiting to run code without logging in. Three weeks later, Unit 42 called the exploitation widespread and mostly automated, with attackers planting backdoors meant to survive patching.