CVE-2026-1281

9.8

CRITICAL CVSS 3.1

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability - [Actively Exploited]

Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

INFO

Published Date :

Jan. 29, 2026, 10:15 p.m.

Last Modified :

Jan. 30, 2026, 1:28 p.m.

Remotely Exploit :

Yes !

Source :

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Feb 01, 2026

Alert Date: Jan 29, 2026 | 22 days ago

Description :

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please: see: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340 ; https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0S-5.noarch.rpm ; https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0L-5.noarch.rpm ; https://nvd.nist.gov/vuln/detail/CVE-2026-1281

Affected Products

The following products are affected by CVE-2026-1281 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Ivanti	endpoint_manager_mobile

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				3c1d8aa1-5a33-4ea4-8992-aadd6440af75
	CVSS 3.1	CRITICAL				MITRE-CVE

Solution

Apply vendor patches for Ivanti Endpoint Manager Mobile to fix remote code execution.

Update Ivanti Endpoint Manager Mobile to the latest version.
Apply all vendor-released security patches.
Review Ivanti's security advisories for specific instructions.

Public PoC/Exploit Available at Github

CVE-2026-1281 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-1281.

URL	Resource
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340	Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-1281 is associated with the following CWEs:

CWE-94: Improper Control of Generation of Code ('Code Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-1281 weaknesses.

CAPEC-35: Leverage Executable Code in Non-Executable Files Leverage Executable Code in Non-Executable Files CAPEC-77: Manipulating User-Controlled Variables Manipulating User-Controlled Variables CAPEC-242: Code Injection Code Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

YunfeiGE18/CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE

A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability (CVE-2026-1281 / CVE-2026-1340) for educational and security research purposes.

Dockerfile Shell

Updated: 12 hours, 36 minutes ago

1 stars 0 fork 0 watcher

Born at : Feb. 19, 2026, 9:29 p.m. This repo has been linked 2 different CVEs too.

eminentv/cve

cve

Dockerfile Rust

Updated: 3 days, 14 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 16, 2026, 7:39 p.m. This repo has been linked 1 different CVEs too.

MehdiLeDeaut/CVE-2026-1281-Ivanti-EPMM-RCE

Proof of Concept for CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE via Bash Arithmetic Expansion

Shell Python

Updated: 1 week, 5 days ago

1 stars 0 fork 0 watcher

Born at : Feb. 7, 2026, 11:28 a.m. This repo has been linked 2 different CVEs too.

lucacapacci/PoC-in-GitHub

Mirror of https://github.com/nomi-sec/PoC-in-GitHub

Updated: 1 week, 4 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 7, 2026, 10:02 a.m. This repo has been linked 789 different CVEs too.

Ashwesker/Ashwesker-CVE-2026-1281

CVE-2026-1281

Python

Updated: 2 weeks, 4 days ago

2 stars 0 fork 0 watcher

Born at : Feb. 1, 2026, 9:57 a.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-1281 vulnerability anywhere in the article.

CybersecurityNews

Critical Ivanti EPMM Zero-Day Vulnerabilities Exploited in The Wild Targeting Corporate Networks

Two critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) have emerged as a major threat to enterprise networks, with active exploitation campaigns targeting corporate infrastruct ...

Published Date: Feb 18, 2026 (1 day, 15 hours ago)

security.nl

'Kritieke Ivanti-kwetsbaarheid sinds zomer vorig jaar misbruikt bij aanvallen'

De Duitse overheid beschikt over technische informatie dat een kritieke kwetsbaarheid in Ivanti EPMM sinds de zomer van vorig jaar is misbruikt bij aanvallen. Op 29 januari dit jaar kwam Ivanti met be ...

Published Date: Feb 18, 2026 (1 day, 18 hours ago)

The Cyber Express

Attackers Deploy Dormant Backdoors in Ivanti EPMM to Bypass Patching of Latest 0-Days

Threat actors weaponized two Ivanti zero-days so quickly that security teams discovered web shells already installed on servers—using arithmetic expansion in bash scripts to slip past authentication e ...

Published Date: Feb 18, 2026 (2 days, 2 hours ago)

Daily CyberSecurity

“Dormant” Backdoors: Ivanti EPMM Zero-Days Exploited to Plant Long-Term Spies

Two critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) are currently being exploited in a widespread campaign to compromise enterprise networks across the globe. A new report f ...

Published Date: Feb 18, 2026 (2 days, 10 hours ago)

CybersecurityNews

Single IP Dominates Exploitation Campaign Attacking Ivanti EPMM with RCE Vulnerability

Single IP Dominates Ivanti EPMM with RCE Vulnerability A critical remote code execution (RCE) flaw in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281, is being heavily exploited. GreyN ...

Published Date: Feb 16, 2026 (3 days, 18 hours ago)

Help Net Security

Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: United Airlines CISO on building resilience when disruption is inevitable In this Help Net Security in ...

Published Date: Feb 15, 2026 (5 days, 1 hour ago)

security.nl

NCSC publiceert verbeterd script voor detectie van gehackte Ivanti-servers

Het Nationaal Cyber Security Centrum (NCSC) heeft in samenwerking met Ivanti een verbeterd script gepubliceerd om gehackte Ivanti Endpoint Manager Mobile (EPMM) servers te detecteren en roept Nederlan ...

Published Date: Feb 13, 2026 (1 week ago)

The Hacker News

83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure

A significant chunk of the exploitation attempts targeting a newly disclosed security flaw in Ivanti Endpoint Manager Mobile (EPMM) can be traced back to a single IP address on bulletproof hosting inf ...

Published Date: Feb 12, 2026 (1 week, 1 day ago)

CybersecurityNews

Massive Spike in Attacks Exploiting Ivanti EPMM Systems 0-day Vulnerability

Ivanti EPMM 0-day Vulnerability Exploited An unprecedented surge in exploitation attempts targeting CVE-2026-1281, a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM). On February 9, 202 ...

Published Date: Feb 11, 2026 (1 week, 1 day ago)

Help Net Security

Ivanti EPMM exploitation: Researchers warn of “sleeper” webshells

A massive wave of exploitation attempts has followed the disclosure of CVE-2026-1281, a critical pre-authentication Ivanti EPMM vulnerability, the Shadowserver Foundation has warned. Some of it is aut ...

Published Date: Feb 11, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMM

A stealthy new cyber espionage campaign is targeting Ivanti Endpoint Manager Mobile (EPMM), but unlike typical ransomware gangs that smash and grab, these attackers are planting seeds and walking away ...

Published Date: Feb 11, 2026 (1 week, 2 days ago)

The Hacker News

Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data

The Netherlands' Dutch Data Protection Authority (AP) and the Council for the Judiciary confirmed both agencies (Rvdr) have disclosed that their systems were impacted by cyber attacks that exploited t ...

Published Date: Feb 10, 2026 (1 week, 3 days ago)

The Cyber Express

European Commission Hit by Mobile Infrastructure Data Breach

The European Commission’s central infrastructure for managing mobile devices was hit by a cyberattack on January 30, the Commission has revealed. The announcement said the European Commission mobile c ...