Full Report
Consider yourselves compromised, experts warn Ivanti has patched two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product that are already being exploited, continuing a grim run of January security incidents for enterprise IT vendors.…
Analysis Summary
# Vulnerability: Ivanti EPMM Unauthenticated Remote Code Execution Zero-Days
## CVE Details
- CVE ID: CVE-2026-1281 and CVE-2026-1340
- CVSS Score: 9.8 (Critical)
- CWE: Not explicitly mentioned, but aligned with insecure process execution or code injection flaws leading to RCE.
## Affected Systems
- Products: Ivanti Endpoint Manager Mobile (EPMM)
- Versions: All vulnerable versions are implied to be prior to patch deployment. (Specific vulnerable version numbers not detailed in the text.)
- Configurations: Relevant to EPMM instances exposed to the internet. Does **not** impact Ivanti Neurons for MDM or Ivanti Endpoint Manager (EPM).
## Vulnerability Description
Two critical, unauthenticated Remote Code Execution (RCE) vulnerabilities exist within Ivanti Endpoint Manager Mobile (EPMM). Successful exploitation allows an attacker to execute arbitrary code remotely without needing credentials, leading to potential compromise of the system, lateral movement, configuration changes, and administrative access. Data potentially exposed includes basic personal information about the EPMM admin and device users (e.g., phone numbers, GPS locations).
## Exploitation
- Status: Exploited in the wild (Zero-day)
- Complexity: Low (Implied by unauthenticated RCE rating)
- Attack Vector: Network (Remote)
## Impact
- Confidentiality: High (Access to admin/user PII and device data)
- Integrity: High (Ability to make configuration changes, install backdoors/web shells)
- Availability: High (Potential for system disruption or full takeover)
## Remediation
### Patches
- Patches have been released by Ivanti. Customers must upgrade to the latest relevant patched version.
### Workarounds
- **Incident Response:** If compromise is suspected, **do not attempt to clean the system; tear down the infrastructure and restore from backups.**
- If restoring from backup is not feasible, build a replacement EPMM device and migrate data.
## Detection
- **Log Review:** Review **Apache access logs**, specifically looking at requests related to the **In-House Application Distribution** and **Android File Transfer Configuration** features.
- Legitimate traffic often results in 200 HTTP response codes.
- Potential exploit activity may result in **404** response codes for GET requests containing parameters with **bash commands**.
- **Suspicious Activity (Post-Exploitation):**
- Look for **POST methods or parameters** in requests targeting error pages like **401.jsp**.
- Investigate unexpected deployment of **.WAR or .JAR files** (potential web shells or persistent access mechanisms).
- Monitor for any **outbound network connections** initiated by EPMM, as the product typically does not make these connections.
## References
- Vendor Advisory: hxxps://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US
- Technical Analysis: hxxps://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US