Ivanti EPMM exploitation: Researchers warn of "sleeper" webshells

Back Helpnetsecurity

Ivanti EPMM exploitation: Researchers warn of "sleeper" webshells

Helpnetsecurity • February 11, 2026

Share: View original

A massive wave of exploitation attempts has followed the disclosure of CVE -2026-1281, a critical pre-authentication Ivanti EPMM vulnerability, ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Widespread Exploitation of Ivanti EPMM Vulnerability CVE-2026-1281 Following the disclosure of CVE-2026-1281, a critical pre-authentication vulnerability in Ivanti EPMM, there has been a significant increase in exploitation attempts. Security researchers have reported targeting activities affecting various organizations, including government entities, with over 600 individual IP addresses involved in these attacks. 2 sources 22

Extracted Entities

Attack Types (2)

Malware Zero-day Exploit

MITRE ATT&CK (2)

T1190 - Exploit Public-Facing Application T1505.003 - Web Shell

Platforms (1)