CVE-2026-1281

What it actually does

This is an unauthenticated remote code execution vulnerability caused by code injection in Ivanti Endpoint Manager Mobile. An attacker who can reach the vulnerable service can send crafted requests that cause attacker-controlled code or commands to execute in the context of the EPMM application or its underlying service account. Because exploitation does not require authentication, compromise can occur before normal access controls, identity checks, or role-based authorization are applied.

Why it matters to the business

A successful attack can give an external attacker control of a mobile device management platform, which is a high-value administrative system used to manage enrolled mobile devices, policies, certificates, applications, and potentially sensitive enterprise configuration data. Operational consequences may include device-management disruption, theft of managed-device metadata, unauthorized policy changes, lateral movement using trusted management infrastructure, and emergency service isolation or rebuilds. The risk is urgent because the vulnerability is listed in CISA KEV, has active in-the-wild exploitation, has a high EPSS score of 0.81518, and the CISA remediation due date of 2026-02-01 has passed.

How an attack unfolds

An attacker first identifies an internet-exposed or otherwise reachable Ivanti Endpoint Manager Mobile instance. They then send a specially crafted unauthenticated request to the vulnerable endpoint that triggers code injection in the EPMM application. If successful, the injected code executes with the privileges of the affected service, allowing the attacker to run commands, stage additional payloads, create persistence, access application data, modify device-management settings, or pivot to adjacent systems reachable from the EPMM server. In active exploitation scenarios, attackers commonly follow initial code execution with reconnaissance, web shell or implant deployment, credential and token harvesting, log tampering, and attempts to use the management platform’s trusted position for broader compromise.

How to fix it

Apply the vendor-provided Ivanti Endpoint Manager Mobile fix or supported upgrade as soon as available from Ivanti. No exact fixed versions were provided in the input, so security teams should verify the applicable fixed release directly against the current Ivanti advisory for CVE-2026-1281 and upgrade all affected EPMM appliances or software instances. Because exploitation is active and the KEV deadline has passed, remediation should be treated as emergency work. If immediate patching is not possible, remove public internet exposure, restrict access to trusted administrative networks or VPNs, apply vendor-recommended mitigations, enforce network-layer allowlisting, monitor aggressively, and consider taking exposed instances offline until they can be patched and validated. For any system suspected of compromise, perform incident response before returning it to production, including credential, token, and certificate rotation where EPMM had access.

How to confirm the fix worked

Confirm exposure by inventorying all Ivanti Endpoint Manager Mobile instances, including appliances, virtual machines, cloud-hosted deployments, and disaster recovery systems. Validate that each instance is running a vendor-confirmed fixed version or has the required hotfix applied. Confirm that management interfaces and APIs are not publicly reachable unless explicitly required and protected by compensating controls. Perform an authenticated administrative version check, review vendor health-check or patch verification commands if available, and compare results to Ivanti’s advisory. After patching, retest externally and internally to confirm the vulnerable service is no longer reachable in an unmitigated state. If exploitation was possible before remediation, validate integrity by reviewing recent file changes, process execution, application logs, authentication events, administrative account changes, scheduled jobs, outbound connections, and unexplained configuration changes.

Typical attack path

1. Scan for reachable Ivanti Endpoint Manager Mobile services, especially internet-facing management portals or APIs.
2. Fingerprint the target to determine whether it appears to be a vulnerable EPMM deployment.
3. Send a crafted unauthenticated request that triggers the code injection flaw.
4. Execute commands or code under the EPMM application/service context.
5. Establish persistence through a web shell, scheduled task, modified application component, or additional implant where possible.
6. Collect configuration data, credentials, tokens, certificates, device metadata, or administrative session material accessible to the application.
7. Modify logs, timestamps, or application files to hinder investigation.
8. Use the compromised management server as a pivot point into internal systems or to manipulate managed-device policies.

How to detect it

Investigate whether the EPMM instance received suspicious unauthenticated requests before patching or isolation. Review reverse proxy, load balancer, WAF, web server, and EPMM application logs for unusual request patterns, unexpected errors, encoded payloads, command-like parameters, abnormal POST bodies, requests from unfamiliar IP addresses, and spikes in 4xx or 5xx responses. On the host, review EDR and operating system telemetry for child processes spawned by EPMM application services, especially shell interpreters, scripting runtimes, download utilities, archive tools, or reconnaissance commands. Search for unexpected files created or modified in EPMM web/application directories, temporary directories, upload directories, and extension/plugin locations. Examine outbound network telemetry for new connections from the EPMM server to unknown external hosts, especially shortly after suspicious inbound requests. Review authentication and administration logs for new accounts, privilege changes, configuration exports, device-management policy changes, certificate operations, and unusual administrator sessions. Because this vulnerability is in KEV and actively exploited, absence of a known public IOC should not be treated as evidence of no compromise; prioritize behavioral evidence, forensic file-system review, and credential/token rotation where exposure existed.

What your security team should do

• Treat this as a priority-one vulnerability because it is unauthenticated RCE, listed in CISA KEV, actively exploited in the wild, and past the 2026-02-01 remediation deadline.
• Immediately identify all Ivanti Endpoint Manager Mobile deployments, including non-production, standby, and legacy instances.
• Patch or upgrade to the Ivanti-confirmed fixed version; if the fixed version is not yet known internally, obtain it from the latest Ivanti advisory before approving remediation closure.
• Remove internet exposure or restrict access to trusted networks until patching and compromise assessment are complete.
• Assume exposed unpatched systems may be compromised and initiate threat hunting across EPMM hosts, reverse proxies, WAFs, identity logs, EDR, and network telemetry.
• Rotate administrative credentials, API keys, service account secrets, certificates, and tokens accessible to EPMM if compromise is suspected or cannot be ruled out.
• Review EPMM administrative activity for unauthorized policy changes, device commands, app deployments, enrollment changes, or configuration exports.
• Preserve forensic evidence before rebuilding or reimaging suspected systems.
• Add detection coverage for suspicious child processes spawned by EPMM services, unexpected file writes in application directories, web shell-like files, and unusual outbound network connections.
• Document remediation evidence, including version, patch date, exposure status, and results of post-remediation compromise assessment.