Ivanti’s EPMM Is Under Active Attack, Thanks to Two Critical Zero-Days

Ivanti’s EPMM is under active attack, thanks to two critical zero-days

Attackers are again focusing on a familiar target in the network edge space, actively exploiting two critical zero-day vulnerabilities in Ivanti software that allows administrators to set mobile device and application controls.  The vulnerabilities — CVE-2026-1281 and CVE-2026-1340 — each carry a CVSS rating of 9.8 and allow unauthenticated users to execute code remotely in Ivanti Endpoint Manager Mobile (EPMM). Ivanti did not say when the earli…

Critical flaws in Ivanti EPMM lead to fast-moving exploitation attempts

Security researchers warn that the initial threat activity was highly targeted, as a limited number of users were impacted prior to disclosure.

Critical flaws in Ivanti EPMM lead to fast-moving exploitation attempts - Cybernoz - Cybersecurity News

Security teams are scrambling Tuesday as two critical vulnerabilities in Ivanti Endpoint Manager Mobile are facing exploitation attempts.  Ivanti issued advisories Thursday for the code injection flaws, which impact the on-premises version of Ivanti EPMM. The vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340, allow an attacker to achieve remote code execution if successfully exploited. The flaws have a severity score of 9.8. Ivanti sai…

Ivanti Issues Urgent Fix for Critical Zero-Day Flaws Under Active Attack

Ivanti has disclosed two critical remote code execution (RCE) flaws (CVE-2026-1281 & CVE-2026-1340) in its EPMM software.