CVE-2026-1340

What it actually does

This is an unauthenticated network-reachable code injection vulnerability that can allow remote code execution on a vulnerable Ivanti Endpoint Manager Mobile deployment. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, exploitation does not require credentials or user interaction and can result in attacker-controlled commands or code running with the privileges of the affected service. The supplied package metadata identifies gitlab-workhorse-ce-fips-18.6 (Chainguard) as affected, with a fixed package version of 18.6.1-r1; organizations should verify product mapping against vendor advisories because the CVE description references Ivanti Endpoint Manager Mobile while the package list references a Chainguard GitLab Workhorse package.

Why it matters to the business

Successful exploitation can give an attacker direct control of an exposed management service, enabling data theft, credential harvesting, configuration tampering, malware deployment, lateral movement, or service disruption. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score of 0.8404, making remediation urgent even where no compromise is currently suspected. CISA’s KEV remediation due date is 2026-04-11. Although ransomware use is not currently indicated in the provided data, unauthenticated RCE in a mobile/device management platform can create a high-impact path to broader enterprise compromise.

How an attack unfolds

An attacker first identifies an Internet-exposed or internally reachable vulnerable instance. They send a crafted unauthenticated request to a vulnerable code path that causes attacker-supplied input to be interpreted as executable code or commands. If successful, the server executes the payload under the vulnerable service account. The attacker can then run reconnaissance commands, drop tools or web shells, establish persistence, exfiltrate configuration secrets or credentials, and pivot to managed devices or adjacent systems. In active exploitation scenarios, attackers commonly automate scanning, validate command execution with simple callbacks, then deploy post-exploitation tooling once a responsive vulnerable target is confirmed.

How to fix it

Patch immediately. For the listed Chainguard package, upgrade gitlab-workhorse-ce-fips-18.6 to version 18.6.1-r1 or later. For Ivanti Endpoint Manager Mobile deployments, apply the vendor-supported fixed release or hotfix for this vulnerability and follow any vendor-specific post-patch hardening guidance. If immediate patching is not possible, remove Internet exposure, restrict access to trusted administrative networks or VPNs, place the service behind strict allowlists, enable WAF or reverse-proxy filtering for suspicious injection patterns, and monitor for unexpected child processes or outbound network connections from the service. Rotate credentials, API keys, certificates, and integration secrets that may have been accessible to the vulnerable service if exploitation is suspected.

How to confirm the fix worked

Confirm that all affected assets have been upgraded to a fixed version, including container images and downstream packages. For the supplied package metadata, verify that gitlab-workhorse-ce-fips-18.6 is no longer present and that 18.6.1-r1 or later is deployed. Use software inventory, package manager output, container image SBOMs, vulnerability scanners, and vendor product version checks to validate remediation. Re-scan externally and internally to ensure no vulnerable service remains exposed. Confirm mitigations by reviewing firewall, reverse-proxy, WAF, and access-control rules. After patching, review service health and ensure no unexpected files, scheduled tasks, startup entries, service accounts, or outbound connections remain from potential pre-patch compromise.

Typical attack path

1. Scan the Internet or internal network for exposed vulnerable Ivanti Endpoint Manager Mobile services or affected packaged deployments.
2. Fingerprint the service and version to determine likely exploitability.
3. Send a crafted unauthenticated request containing injected code or command syntax to the vulnerable endpoint.
4. Confirm remote code execution through command output, timing behavior, DNS/HTTP callbacks, or outbound beaconing.
5. Execute operating system reconnaissance commands to identify privileges, network access, secrets, and installed tooling.
6. Deploy a web shell, reverse shell, or additional payload to maintain access.
7. Harvest credentials, tokens, configuration files, certificates, or database connection material accessible to the service.
8. Move laterally to managed devices, identity systems, source repositories, CI/CD systems, or other internal services if reachable.
9. Cover tracks by deleting files, clearing logs, modifying timestamps, or blending activity into normal service traffic.

How to detect it

To determine whether exploitation has already occurred, review web server, application, reverse-proxy, WAF, load balancer, authentication, EDR, process creation, DNS, and outbound firewall/proxy logs for the affected service. Look for unauthenticated requests that produce errors, unusual parameters, encoded payloads, shell metacharacters, command separators, or payloads followed by process creation. Correlate inbound requests to subsequent child processes spawned by the service, especially shells, scripting runtimes, download utilities, archive tools, network scanners, or reverse-shell utilities. Review filesystem changes around the time of suspicious requests, especially new executable files, scripts, web-accessible files, temporary files, modified service configuration, scheduled jobs, startup entries, and abnormal log deletion. Inspect outbound DNS and HTTP/S connections from the server to unfamiliar domains, newly registered domains, IP literals, paste sites, file-sharing services, VPS providers, or attacker-controlled callback infrastructure. Because active exploitation is reported and the KEV catalog includes this vulnerability, absence of known public IOCs should not be treated as absence of compromise; prioritize behavior-based hunting and forensic review.

What your security team should do

• Treat this as an emergency patching item because it is unauthenticated RCE, listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS probability.
• Identify all Internet-facing and internally reachable Ivanti Endpoint Manager Mobile deployments and any systems containing the listed affected package.
• Upgrade gitlab-workhorse-ce-fips-18.6 to 18.6.1-r1 or later where present, and apply the appropriate Ivanti fixed release or hotfix for EPMM deployments after validating vendor mapping.
• Temporarily restrict access to vulnerable services to trusted administrative networks until patching is complete.
• Hunt for evidence of exploitation before and after patching using web, application, reverse-proxy, WAF, EDR, process, DNS, and outbound network telemetry.
• Investigate any service process spawning shells, scripting interpreters, download utilities, or network utilities.
• Rotate credentials and integration secrets stored on or accessible from vulnerable servers if exploitation cannot be confidently ruled out.
• Preserve logs and forensic artifacts before rebuilding or decommissioning compromised hosts.
• Prioritize assets exposed to the Internet, integrated with identity providers, managing mobile devices, or holding administrative credentials.
• Track the CISA KEV due date of 2026-04-11 and document remediation completion for compliance and audit purposes.