Ivanti warns of two EPMM flaws exploited in zero-day attacks

Ivanti warns of two EPMM flaws exploited in zero-day attacks

Ivanti has disclosed two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, that were exploited in zero-day attacks.

Ivanti Patches Two Exploited Zero-Days In Mobile Manager

Two code injection vulnerabilities allowed unauthenticated attackers to execute arbitrary code and access sensitive device information across compromised networks. Ivanti released emergency patches for two critical zero-day vulnerabilities in Endpoint Manager Mobile after discovering attackers exploited the flaws to compromise customer systems. The company confirmed a limited number of organizations fell victim to attacks leveraging CVE-2026-128…

Two Ivanti EPMM Zero-Day RCE Flaws Actively Exploited, Security Updates Released

Ivanti has rolled out security updates to address two security flaws impacting Ivanti Endpoint Manager Mobile (EPMM) that have been exploited in zero-day attacks, one of which has been added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog. The critical-severity vulnerabilities are listed below CVE-2026-1281 (CVSS score:

Ivanti provides temporary patches for actively exploited EPMM zero-day (CVE-2026-1281)

Ivanti released patches for two critical vulnerabilities in Endpoint Manager Mobile (EPMM), one of which (CVE-2026-1281) is being exploited.

Ivanti Warns Of Two EPMM Flaws Exploited In Zero-day Attacks - Cybernoz - Cybersecurity News

Ivanti has disclosed two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, that were exploited in zero-day attacks. The flaws are code-injection vulnerabilities that allow remote attackers to execute arbitrary code on vulnerable devices without authentication. Both vulnerabilities have a CVSS score of 9.8 and are rated as critical. “We are aware of a very limited number of customers wh…

CISA Adds One Known Exploited Vulnerability to Catalog

CISA Adds One Known Exploited Vulnerability to Catalog ggaylor Jan 29, 2026 Release DateJanuary 29, 2026 DescriptionCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the fe…