CVE-2026-1340

9.8

CRITICAL CVSS 3.1

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability - [Actively Exploited]

Overview

Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Details

INFO

Published Date :

Jan. 29, 2026, 10:15 p.m.

Last Modified :

April 9, 2026, 2:03 p.m.

Remotely Exploit :

Yes !

Source :

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Apr 11, 2026

Alert Date: Apr 08, 2026 | 12 days ago

Description :

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please see: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US ; https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0S-5.noarch.rpm ; https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0L-5.noarch.rpm ; https://nvd.nist.gov/vuln/detail/CVE-2026-1340

Impact

Affected Products

The following products are affected by CVE-2026-1340 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Ivanti	endpoint_manager_mobile

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				3c1d8aa1-5a33-4ea4-8992-aadd6440af75
	CVSS 3.1	CRITICAL				MITRE-CVE

Solution

Address unauthenticated remote code execution via code injection.

Apply vendor patches or updates immediately.
Review Ivanti Endpoint Manager Mobile security settings.
Restrict network access to the affected system.
Monitor for suspicious activities.

Public PoC/Exploit Available at Github

CVE-2026-1340 has a 7 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-1340.

URL	Resource
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1340	Third Party Advisory US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-1340 is associated with the following CWEs:

CWE-94: Improper Control of Generation of Code ('Code Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-1340 weaknesses.

CAPEC-35: Leverage Executable Code in Non-Executable Files Leverage Executable Code in Non-Executable Files CAPEC-77: Manipulating User-Controlled Variables Manipulating User-Controlled Variables CAPEC-242: Code Injection Code Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

packet-noir/kev_rec

Retrieves CVEs added in the last N days from CISA's Known Exploited Vulnerability (KEV) database.

Python

Updated: 3 days, 21 hours ago

0 stars 0 fork 0 watcher

Born at : April 8, 2026, 1:52 a.m. This repo has been linked 3 different CVEs too.

myseq/tracker

Security Tracker

Python

Updated: 1 week, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 3, 2026, 11 a.m. This repo has been linked 5 different CVEs too.

dalisecurity/Fray

Open-source WAF bypass toolkit — 4,300+ payloads, 35+ recon checks, 98 WAF/CDN vendors, AI-assisted bypass, security hardening. For pentesters, bug bounty hunters, and DevSecOps.

owasp payload-database cloudflare vulnerability waf xss mcp-server bugbounty pentesting recon mcp waf-bypass attack-surface penetration-testing python security security-tools sql-injection vulnerability-scanner waf-detection

Dockerfile Python TypeScript HTML Ruby Shell

Updated: 1 month, 1 week ago

46 stars 3 fork 3 watcher

Born at : March 1, 2026, 5:22 p.m. This repo has been linked 2 different CVEs too.

YunfeiGE18/CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE

A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability (CVE-2026-1281 / CVE-2026-1340) for educational and security research purposes.

Dockerfile Shell

Updated: 2 months ago

1 stars 0 fork 0 watcher

Born at : Feb. 19, 2026, 9:29 p.m. This repo has been linked 2 different CVEs too.

MehdiLeDeaut/CVE-2026-1281-Ivanti-EPMM-RCE

Proof of Concept for CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE via Bash Arithmetic Expansion

Shell Python

Updated: 2 months, 1 week ago

1 stars 0 fork 0 watcher

Born at : Feb. 7, 2026, 11:28 a.m. This repo has been linked 2 different CVEs too.

Ashwesker/Ashwesker-CVE-2026-1281

CVE-2026-1281

Python

Updated: 2 months, 2 weeks ago

2 stars 0 fork 0 watcher

Born at : Feb. 1, 2026, 9:57 a.m. This repo has been linked 2 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 weeks, 1 day ago

7620 stars 1243 fork 1243 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 766 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-1340 vulnerability anywhere in the article.

Daily CyberSecurity

Active SharePoint Spoofing and Legacy Office RCE: CISA Alerts on New KEV Exploits

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, sounding a fresh warning about two high-risk security flaws currently being ...

Published Date: Apr 15, 2026 (5 days, 18 hours ago)

Daily CyberSecurity

The CVE Watchtower: Weekly Threat Intelligence Briefing (April 6 – April 12, 2026)

Welcome to this week’s vulnerability digest. As we close out the first full week of April, security teams are faced with a challenging landscape of critical zero-days, active exploitations, and severe ...

Published Date: Apr 13, 2026 (1 week ago)

Daily CyberSecurity

Encryption Bypasses and Kubernetes Token Leaks Hit Apache Tomcat

Apache Tomcat, the open-source backbone for millions of Java-based web applications, has been hit by a wave of security disclosures. A comprehensive audit has revealed ten distinct vulnerabilities aff ...

Published Date: Apr 13, 2026 (1 week ago)

Daily CyberSecurity

Root Access at Risk: Critical Nix Sandbox Escape Overwrites Sensitive System Files

A severe security vulnerability has been identified in the Nix package manager, a tool celebrated by the Linux and Unix communities for making package management reliable and reproducible. Tracked as ...

Published Date: Apr 10, 2026 (1 week, 3 days ago)

Daily CyberSecurity

Critical Privilege Escalation in Checkmk: Root Access at Risk

A critical-severity security vulnerability has been identified in the Checkmk monitoring platform, potentially allowing local users to seize full control of the host system. The flaw, tracked as CVE-2 ...

Published Date: Apr 10, 2026 (1 week, 3 days ago)

Daily CyberSecurity

HPE Aruba Patches High-Severity Credential Theft Flaw

HPE Aruba Networking has issued an important software update to address a high-severity security flaw in its Private 5G Core On-Prem Platform. The vulnerability, tracked as CVE-2026-23818, could allow ...

Published Date: Apr 10, 2026 (1 week, 3 days ago)

Daily CyberSecurity

TP-Link Archer AX53 Hit by Multiple High-Severity Vulnerabilities

TP-Link has issued an urgent security advisory regarding its Archer AX53 v1.0 router, detailing five distinct vulnerabilities that could allow attackers to seize control of the device or leak sensitiv ...

Published Date: Apr 10, 2026 (1 week, 3 days ago)

Daily CyberSecurity

Cloud Engineering at Risk: AWS Patches Critical Privilege Escalation and RCE Flaws in RES

Research and Engineering Studio on AWS architecture | Image: AWS Amazon Web Services (AWS) has released urgent security updates for its Research and Engineering Studio (RES), an open-source portal des ...