Two Critical vulnerabilities in Ivanti’s popular mobile device management solution have been exploited in the wild in limited attacks

CVE-2026-1281, CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Vulnerabilities Exploited

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

CISA has given federal agencies four days to patch a critical flaw in Ivanti EPMM that was exploited in the wild as a zero-day in January.

Two Ivanti Endpoint Manager Mobile zero-day flaws were exploited in the wild in limited attacks. Apply the available patches immediately.

Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.8.0.0 are affected by a vulnerability allowing an unauthenticated remote attacker to execute arbitrary code on the affected system through a specially crafted request.

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is prior to 12.6.1.1, 12.7.x prior to 12.7.0.1, or 12.8.x prior to 12.8.0.1. It is, therefore, affected by multiple vulnerabilities:

  - A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code     execution. (CVE-2026-1281, CVE-2026-1340)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number.

ID	Name	Product	Family	Severity
115128	Ivanti Endpoint Manager Mobile < 12.8.0.0 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
297219	Ivanti Endpoint Manager Mobile < 12.6.1.1 / 12.7 < 12.7.0.1 / 12.8 < 12.8.0.1 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-1340

critical

Tenable Plugins

critical

critical