CVE-2026-1281: Ivanti Endpoint Manager Mobile unauthenticated code injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution (CVSS 9.8) in a privileged management appliance, with KEV listing and near-certain EPSS probability, makes this an urgent patch-first item.

What it is

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection flaw (CWE-94) that permits unauthenticated remote code execution. With a CVSS 3.1 base score of 9.8 and network reachability requiring no privileges or user interaction, this is a severe pre-auth flaw in a mobile device management server. It matters because EPMM sits in a privileged management position, so compromise can cascade to managed endpoints.

Impact

An attacker gains remote code execution on the EPMM server without authenticating, which can lead to full control of the host and the managed mobile estate it administers. The record does not specify the exact code execution context or privilege level obtained.

Attack surface

Reachable over the network per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not identify the specific endpoint or interface that is exposed.

Exploitation

CVE-2026-1281 was added to CISA KEV on 2026-01-29 with a remediation due date of 2026-02-01, indicating known exploitation in the wild. EPSS is 0.98487 (99.9th percentile), and the vendor advisory is tagged Patch; no ransomware campaign use is documented.

What to do

• Apply the vendor patch from the Ivanti security advisory for CVE-2026-1281 (and CVE-2026-1340) immediately.
• If patching cannot be completed before the KEV due date, apply Ivanti's documented mitigations or discontinue use of the product per BOD 22-01 guidance.
• Restrict network access to EPMM management interfaces to trusted administrative networks and block exposure to the internet.
• Audit EPMM for signs of compromise and rotate credentials and certificates used by the appliance after remediation.
• Track the KEV due date of 2026-02-01 and confirm remediation status for all EPMM instances.

Detection

• Monitor EPMM server logs and web/proxy logs for anomalous requests to management interfaces, especially unauthenticated POST or request patterns preceding process or command execution.
• Alert on unexpected child processes spawned by the EPMM application or web server (for example shells or scripting interpreters).
• Watch for new or modified files, scheduled tasks, or service changes on the EPMM host outside of maintenance windows.
• Review outbound network connections from the EPMM appliance to unfamiliar destinations for post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.