Back Cisecurity

Multiple Vulnerabilities in Ivanti Endpoint Manager Mobile Could Allow for Remote Code Execution

Cisecurity • January 30, 2026

Multiple vulnerabilities have been discovered in Ivanti Endpoint Manager Mobile which could allow for remote code execution. Ivanti Endpoint Manager Mobile is a mobile management software engine that enables IT to set policies for mobile devices, applications and content. Successful exploitation of these vulnerabilities could allow for remote code execution in the context of the user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; make configuration changes on devices; or create new accounts with full user rights.

According to Ivanti, the exploitation of these vulnerabilities have been observed in a limited number of customers.

Multiple vulnerabilities have been discovered in Ivanti Endpoint Manager Mobile which could allow for remote code execution. Details of these vulnerabilities are as follows:

Tactic: Initial Access ( TA0001 ):

Technique: Exploit Public-Facing Application ( T1190 ):

Successful exploitation of these vulnerabilities could allow for remote code execution in the context of the user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; make configuration changes on devices; or create new accounts with full user rights.

We recommend the following actions be taken:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Ivanti EPMM Vulnerabilities Under Active Exploitation Two critical vulnerabilities in Ivanti's Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, have been actively exploited in the wild, allowing unauthenticated remote code execution (RCE) with a CVSS score of 9.8. These vulnerabilities were disclosed on January 29, 2026, and have since been added to CISA's Known Exploited Vulnerabilities catalog. Exploitation has been observed across various sectors, including government and healthcare, with attackers leveraging these flaws to gain unauthorized access to sensitive device management data. The vulnerabilities stem from code injection issues in the In-House Application Distribution and Android File Transfer Configuration features of EPMM. Ivanti has released emergency patches and advised organizations to apply them immediately to mitigate risks. However, the patches do not survive version upgrades, necessitating ongoing vigilance. The attack vector has been linked to a broader trend of rapid exploitation following vulnerability disclosures, raising concerns about the security of mobile device management systems. 63 sources 73

Extracted Entities

Multiple Vulnerabilities in Ivanti Endpoint Manager Mobile Could Allow for Remote Code Execution

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)