Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Critical Vulnerabilities in Ivanti EPMM Exploited

Summary: Two critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile, CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8), are being actively exploited to let unauthenticated attackers run arbitrary code on MDM servers, and CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities Catalog. Unit 42 reports widespread, mostly automated exploitation that moved from reconnaissance to second-stage payloads including JSP web shells, reverse shells, a Nezha monitoring agent, and dormant backdoors, with Cortex Xpanse telemetry showing over 4,400 EPMM instances.

What you should know: Attackers are installing backdoors meant to survive patching, so applying Ivanti's RPM update alone does not close the exposure - and with more than 4,400 EPMM instances visible in telemetry, the population of unpatched, internet-facing management appliances is large enough for automated scanning to find them within hours of disclosure.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Zero-Days & Exploits
Mentions
CVE-2026-1281CVE-2026-12821CVE-2026-1340
Related