CVE-2026-1340: Ivanti Endpoint Manager Mobile code injection enables unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score, confirmed exploitation via CISA KEV, and a near-maximum EPSS probability.

What it is

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection flaw (CWE-94) that allows attackers to achieve unauthenticated remote code execution. With a CVSS 3.1 base score of 9.8 and network reachability requiring no privileges or user interaction, this is a severe pre-authentication flaw in a mobile device management platform. The record does not specify affected versions or the exact injection point.

Impact

A successful attacker executes arbitrary code on the EPMM server with the privileges of the vulnerable component, giving full compromise of the management platform. Because EPMM manages enrolled mobile devices, that access can extend to managed endpoints and their data.

Attack surface

Reachable over the network per the CVSS vector (AV:N), with no authentication (PR:N) and no user interaction (UI:N) required. The description does not identify the specific endpoint or parameter that carries the injected code.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2026-04-08 with a remediation due date of 2026-04-11, indicating active exploitation. EPSS is 0.98592 (99.9th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor fix from the Ivanti security advisory for CVE-2026-1340 as the first action; if no patch is available, follow Ivanti's stated mitigations or discontinue use per CISA's required action.
• Restrict network access to the EPMM management interface to trusted administrative networks and block exposure to the internet.
• Monitor Ivanti's advisory for affected version details, since the record does not list them, and confirm your deployed version against it.
• Treat any EPMM host as potentially compromised if it was internet-facing before remediation, and review it for signs of intrusion.
• Follow BOD 22-01 guidance for any cloud-hosted EPMM instances.

Detection

• Hunt for unexpected child processes spawned by the EPMM web/application service, especially shells or interpreters, which would indicate injected code execution.
• Review EPMM server logs and web access logs for anomalous requests to management endpoints, particularly from untrusted source addresses.
• Monitor for outbound connections from the EPMM host to unfamiliar destinations, consistent with post-exploitation activity.
• Alert on file creation or modification in EPMM application directories outside of expected update windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.