⚠️ DISCLAIMER: This PoC is provided solely for educational and security research purposes. Unauthorized use is illegal.
⚠️ DISCLAIMER: This PoC is provided solely for educational and security research purposes. Unauthorized use is illegal.
Complete Proof of Concept (PoC) for exploiting the CVE-2026-1281 and CVE-2026-1340 vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM). These vulnerabilities allow unauthenticated remote code execution (RCE) via a Bash Arithmetic Expansion mechanism.
CVE-2026-1281 : Code injection in the /mifs/c/appstore/fob/ endpoint
CVE-2026-1340 : Code injection in the /mifs/c/aftstore/fob/ endpoint
CVSS Score : 9.8 (Critical)
Exploitation : Active in-the-wild (Zero-Day)
✅ Automated validation framework (8 tests)
✅ Pre-Auth RCE exploitation
✅ Automatic reverse shell
✅ Webshell deployment
✅ 50+ ready-to-use payloads
✅ Detection scripts for Blue Team
✅ Complete documentation
Full README - Detailed technical documentation
Usage guide - Step-by-step guide
Payloads - Collection of 50+ payloads
Red Team guide - Operational scenarios
CERT-FR CERTFR-2026-ALE-001
Watchtowr Labs Analysis
Mehdi Le Deaut - Cybersecurity Consultant | Red Team Specialist
This project is licensed under the MIT License - see the LICENSE file for details.
CERT-FR for the rapid alert
Watchtowr Labs for the technical analysis
The cybersecurity community
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
