Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates Released
Summary: Ivanti released security updates for two critical zero-day flaws in Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, affecting the In-House Application Distribution and Android File Transfer Configuration features, with Ivanti reporting a very limited number of exploited customers at disclosure. CISA added CVE-2026-1281 to its KEV catalog with a February 1, 2026 patch deadline for FCEB agencies, and added CVE-2026-1340 on April 8, 2026 with a deadline of April 11, 2026; permanent fixes are slated for EPMM version 12.8.0.0 in Q1 2026.
What's compelling: Rapid7's honeypot logged hundreds of inbound connections from more than 130 unique IP addresses in 24 hours, with 58% directly attempting exploitation and payloads built for reverse shells over port 443 and webshell deployment, and watchTowr's CEO said organizations exposing vulnerable instances to the internet at disclosure must consider them compromised.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-1281CVE-2026-1340
- Related