Quick Summary
Ivanti has addressed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, tracked as CVE-2026-1281 and CVE-2026-1340. Both vulnerabilities have a CVSS score of 9.8 and allow for unauthenticated remote code execution, posing significant risks to affected systems. As of the disclosure, a limited number of customers have been exploited, highlighting the urgency for organizations to patch their systems to prevent further compromise.
The Securityish Brief
Ivanti has patched two serious zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, identified as CVE-2026-1281 and CVE-2026-1340. Both vulnerabilities are rated with a CVSS score of 9.8, indicating their critical nature, and they allow for unauthenticated remote code execution (RCE). This means that attackers could potentially exploit these vulnerabilities to gain unauthorized access to systems and sensitive data.
As of the disclosure, Ivanti reported that a very limited number of customers had already experienced exploitation. The vulnerabilities do not affect other Ivanti products, including cloud solutions like Ivanti Neurons for MDM. However, the risks associated with these RCE vulnerabilities are severe, as they could lead to lateral movement within networks, unauthorized configuration changes, and the potential for attackers to escalate their privileges.
Ivanti has advised organizations to monitor their systems closely for signs of compromise, particularly focusing on unusual traffic patterns or unexpected outbound connections. The company also noted that previous incidents involving EPMM have shown that attackers often use web shells and other persistence methods to maintain access.
Practical Implications for Organizations
Organizations using Ivanti’s EPMM should prioritize applying the latest patches to mitigate the risks associated with these vulnerabilities. Given the potential for data exposure, including personal information about device users and administrators, it is crucial for affected customers to act swiftly.
In the event of a suspected compromise, Ivanti recommends restoring from backups instead of attempting to clean the system. If backups are not available, organizations should consider building a new EPMM device and migrating their data to it. This approach minimizes the risk of lingering threats from compromised systems.
Benjamin Harris, CEO at watchTowr, emphasized the urgency for organizations in high-value industries to respond quickly to these vulnerabilities, as they represent a significant threat from well-resourced attackers. The ongoing exploitation of these zero-days underscores the importance of maintaining robust security practices and incident response protocols.
- CVE-2026-1281: A critical vulnerability in Ivanti’s EPMM allowing unauthenticated remote code execution.
- CVE-2026-1340: Another critical vulnerability in Ivanti’s EPMM with the same severe implications.
Key Takeaways
- Apply the latest patches from Ivanti for the EPMM product immediately to mitigate risks.
- Monitor network traffic for unusual patterns, especially unexpected outbound connections.
- Review Apache access logs for suspicious requests, particularly to error pages.
- If a compromise is suspected, restore from backups rather than attempting to clean the system.
- Consider building a replacement EPMM device if backups are unavailable to ensure security.
Key Terms & Concepts
- CVE: In this article, CVE refers to a standardized identifier for publicly known cybersecurity vulnerabilities.
- Remote Code Execution (RCE): RCE is a type of vulnerability that allows an attacker to execute arbitrary code on a remote system.
- CVSS: CVSS is a scoring system used to assess the severity of vulnerabilities in software.
- Ivanti Endpoint Manager Mobile (EPMM): EPMM is a product by Ivanti designed for managing mobile devices and applications.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/30/ivanti_epmm_zero_days/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
