The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Ivanti EPMM to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti EPMM vulnerability, tracked as CVE-2026-1281 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability is a code injection that impacts Ivanti Endpoint Manager Mobile. An unauthenticated attacker can exploit the vulnerability to achieve remote code execution.
“A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.” reads the advisory.
The company confirmed that it is aware of attacks in the wild exploiting this vulnerability.
“We are aware of a very limited number of customers who have been exploited at the time of disclosure.” continues the advisory.
Ivanti said the investigation is ongoing and no reliable indicators of compromise are available yet, though technical guidance has been shared. Sentry and Ivanti Neurons for MDM are not vulnerable, and cloud customers are unaffected. Ivanti has released a patch, expanded customer support, and is working with security partners and law enforcement.
EXPLORE MORE
Newegg Reveals Fall 2026’s 5 Best Prebuilt Gaming PCs That Dominate Performance
Fall 2026 is shaping up to be an absolute renaissance for PC…
China-linked Amaranth-Dragon hackers target Southeast Asian governments in 2025
China-linked hackers tracked as Amaranth-Dragon targeted government and law enforcement agencies across…
Ryzen 7 7800X3D and RTX 5070 Gaming PC Drops $500 to $1799
Get $500 Off This Ryzen 7 7800X3D and RTX 5070 Gaming PC…
Attackers abuse SolarWinds Web Help Desk to install Zoho agents and Velociraptor
Huntress confirmed active SolarWinds Web Help Desk exploits, where attackers installed Zoho…
Dutch agencies hit by Ivanti EPMM exploit exposing employee contact data
Dutch agencies confirmed attacks exploiting Ivanti EPMM flaws that exposed employee contact…
The Iran War Has Turned VLCCs Into $650,000-A-Day Assets
Authored by Julianne Geiger via OilPrice.com, More Gulf oil is moving again.…
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by February 2, 2026.
US CISA also published an alert related to this flaw titled “Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858“
