Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting

Recent analysis by GreyNoise revealed that 83% of exploitation attempts against Ivanti Endpoint Manager Mobile (EPMM) can be traced to a single IP address, 193.24.123.42, on bulletproof hosting infrastructure operated by PROSPERO. Between February 1 and 9, 2026, a total of 417 exploitation sessions were recorded from eight unique source IP addresses, with the majority linked to this single IP. The vulnerabilities being targeted are CVE-2026-1281 and CVE-2026-1340, both of which have a CVSS score of 9.8, indicating critical severity and the potential for unauthenticated remote code execution.

Ivanti acknowledged that a very limited number of customers were impacted by these zero-day exploits. Notably, multiple European agencies, including the Dutch Data Protection Authority and the European Commission, reported being targeted by threat actors leveraging these vulnerabilities. The malicious activity is characterized by a high degree of automation, with the same host exploiting three other unrelated CVEs and utilizing over 300 unique user agent strings.

GreyNoise also noted that 85% of the exploitation sessions confirmed the target’s vulnerability via DNS without deploying malware or exfiltrating data. This pattern suggests a reconnaissance phase where attackers catalog potential targets before executing further exploits.

Implications for Organizations

The exploitation of EPMM poses significant risks, as it provides access to device management infrastructure for entire organizations. This access can facilitate lateral movement within networks, bypassing traditional security measures. Organizations with internet-facing Mobile Device Management (MDM) systems should be particularly vigilant, as critical vulnerabilities can be exploited within hours of disclosure.

Given the automated nature of the attacks and the use of diverse fingerprints, organizations must audit their MDM infrastructure and review DNS logs for any suspicious activity. The ongoing threat from PROSPERO’s infrastructure highlights the importance of proactive security measures.

To mitigate risks, Ivanti EPMM users are advised to apply available patches and monitor for specific indicators of compromise, such as the /mifs/403.jsp path. Blocking PROSPERO’s autonomous system (AS200593) at the network perimeter level is also recommended to prevent further exploitation.

• Ivanti Endpoint Manager Mobile (EPMM): Affected by critical vulnerabilities allowing remote code execution.
• CVE-2026-1281: A critical vulnerability in EPMM with a CVSS score of 9.8.
• CVE-2026-1340: Another critical vulnerability in EPMM that can be exploited similarly.
• PROSPERO: The bulletproof hosting provider linked to the exploitation attempts.
• GreyNoise: The threat intelligence firm that reported on the exploitation sessions.