CISA Warns of Critical Ivanti EPMM Code Injection Vulnerability Exploited in Attacks

Cybersecuritynews •Abinaya • April 9, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical security flaw in Ivanti Endpoint Manager Mobile (EPMM). The agency recently added this flaw, tracked as CVE-2026-1340, to its Known Exploited Vulnerabilities (KEV) catalog after confirming it is being actively exploited in real-world cyberattacks. This means the software fails to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Urgent CISA Directive: Patch Critical Ivanti EPMM Vulnerability CVE-2026-1340 by April 11 The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that U.S. federal agencies patch a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1340, by April 11, 2026. This code injection flaw allows unauthenticated attackers to execute arbitrary code on unpatched systems, posing significant risks to federal and private sector organizations. The vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on April 8, 2026, following confirmed exploitation in real-world attacks. Ivanti had previously disclosed the flaw in January 2026, alongside another vulnerability (CVE-2026-1281), both of which have been actively exploited. CISA's directive emphasizes the urgency for all organizations to prioritize remediation efforts to mitigate potential breaches. Security researchers have identified numerous EPMM instances still exposed online, increasing the risk of exploitation. Organizations are urged to apply vendor-recommended patches immediately to secure their systems. 12 sources 80

Extracted Entities

CVEs (1)

CVE-2026-1340