Skip to content
Critical RCE Vulnerabilities in Ivanti EPMM

Critical RCE Vulnerabilities in Ivanti EPMM

First seen 18 Oct 2026, 15:07 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 17:39 UTC
  • •CVE-2026-1281 and CVE-2026-1340 allow unauthenticated RCE in Ivanti EPMM.
  • •Both vulnerabilities have a CVSS score of 9.8, indicating critical severity.
  • •Exploitation is confirmed in the wild, with a PoC available for attackers.

Two critical vulnerabilities, CVE-2026-1281 and CVE-2026-1340, affecting Ivanti Endpoint Manager Mobile (EPMM) have been confirmed to allow unauthenticated remote code execution (RCE) through a Bash Arithmetic Expansion mechanism. The vulnerabilities were published on January 29, 2026, with a CVSS score of 9.8, indicating a critical severity. The exploitation is currently active in the wild, and a proof of concept (PoC) has been released, providing tools for automated exploitation. The PoC includes over 50 ready-to-use payloads and detection scripts for Blue Team operations. Security teams are advised to prioritize mitigation strategies against these vulnerabilities, as they pose a significant risk to affected systems. The vulnerabilities specifically target endpoints at /mifs/c/appstore/fob/ and /mifs/c/aftstore/fob/. CERT-FR has issued alerts regarding the of these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-29
CVE-2026-1281 and CVE-2026-1340 published
Ivanti disclosed two critical vulnerabilities allowing RCE in EPMM, with a CVSS score of 9.8.
Kitploit
2026-04-08
CVE-2026-1340 added to CISA KEV
CISA included CVE-2026-1340 in its Known Exploited Vulnerabilities catalog due to active exploitation.
Kitploit
2026-10-18
Public PoC released
A complete PoC for exploiting both vulnerabilities was released, including automated exploitation tools.
Kitploit

More articles in this cluster (4)

Following this threat?

Track CVE-2026-1281 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4

Common questions

Which systems are affected?
Ivanti Endpoint Manager Mobile (EPMM) systems are affected by CVE-2026-1281 and CVE-2026-1340.
How urgent is this threat?
The vulnerabilities are actively exploited in the wild, making immediate action necessary.
What mitigation steps should be taken?
Security teams should implement the provided detection scripts and consider disabling affected endpoints until a patch is available.