Ivanti EPMM Vulnerability CVE-2026-1281 Exploited with Sleeper Webshells
- Securityish
- Threats & Incidents
Quick Summary
A significant wave of exploitation attempts has emerged following the discovery of CVE-2026-1281, a critical vulnerability in Ivanti’s Endpoint Manager Mobile (EPMM). The Dutch Data Protection Authority and Valtori, Finland’s central government ICT service center, are among the confirmed victims of this vulnerability. Researchers have identified ‘sleeper’ webshells being deployed to compromised systems, which can be activated later for further exploitation, raising serious concerns about ongoing security risks for affected organizations.
The Securityish Brief
Following the disclosure of CVE-2026-1281 on January 29, 2026, Ivanti’s Endpoint Manager Mobile (EPMM) has been the target of extensive exploitation attempts. This vulnerability allows for code injection without authentication, leading to significant risks for organizations using the platform. The Dutch Data Protection Authority and Valtori, Finland’s central government ICT service center, have confirmed breaches linked to this vulnerability.
Researchers from Greynoise and Defused Cyber have reported that an initial access broker is preparing unpatched EPMM instances with dormant ‘sleeper’ webshells. These webshells, located at /mifs/403.jsp, require a specific trigger to activate, indicating a methodical approach to exploitation. As of now, these implants have not been observed to deploy malware or exfiltrate data but are used to verify system exploitability.
Ivanti, in collaboration with the Dutch National Cyber Security Center (NCSC-NL), has released a detection script to help organizations identify potential exploitation in their environments. The NCSC-NL has advised all users of Ivanti EPMM to assume they have been compromised and to conduct thorough forensic investigations.
Organizations are urged to patch their Ivanti EPMM instances and review access logs for indicators of compromise shared by Defused Cyber. The urgency of these actions is underscored by the fact that the vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalog on the same day they were disclosed.
Implications for Organizations
The exploitation of CVE-2026-1281 highlights the critical need for organizations to maintain up-to-date security practices. With initial access brokers preparing systems for future attacks, organizations must be vigilant in monitoring their networks for unusual activity.
As the situation evolves, organizations should prioritize patching vulnerabilities and implementing robust monitoring solutions. The presence of sleeper webshells indicates that attackers are increasingly sophisticated, requiring a proactive approach to cybersecurity.
Key Takeaways
- Patch your Ivanti EPMM instances immediately to mitigate the risk of exploitation.
- Conduct a forensic investigation to determine if your systems have been compromised.
- Review access logs using the indicators of compromise provided by Defused Cyber.
- Restart application servers to flush any in-memory implants that may have been deployed.
- Monitor your network for unusual activity that could indicate further exploitation attempts.
Key Terms & Concepts
- CVE-2026-1281: In this article, CVE-2026-1281 refers to a critical vulnerability in Ivanti’s Endpoint Manager Mobile that allows code injection without authentication.
- Sleeper webshells: Sleeper webshells are dormant malicious scripts placed on compromised systems that can be activated later for exploitation.
- NCSC-NL: NCSC-NL stands for the Dutch National Cyber Security Center, which assists organizations in managing cybersecurity risks.
Read the original article here: https://www.helpnetsecurity.com/2026/02/11/ivanti-epmm-sleeper-webshell/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
