{"id":"CVE-2026-1340","published":"2026-01-29T22:15:53Z","modified":"2026-06-17T10:15:37Z","title":"Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability","vendor":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","tier":"core","eol":null,"description":{"text":"A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.","provenance":"source","from":"NVD"},"summary":{"text":"A code injection flaw in Ivanti Endpoint Manager Mobile (EPMM) lets an attacker inject code that the product then executes. An attacker with network access to the product can achieve remote code execution without authentication or any user interaction, and the flaw is not dependent on a particular non-default configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:19Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98639,"percentile":0.99924,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-04-08","dueDate":"2026-04-11","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please see: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US ; https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0S-5.noarch.rpm ; https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0L-5.noarch.rpm ; https://nvd.nist.gov/vuln/detail/CVE-2026-1340","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-02-04","exploitedFirstSeen":"2026-02-04","ransomware":true,"evidence":[{"url":"https://tracker.crowdsec.net/cves/CVE-2026-1340","date":"2026-02-04"},{"url":"https://defusedcyber.com/ivanti-epmm-sleeper-shells-403jsp","date":"2026-02-09"},{"url":"https://www.greynoise.io/blog/active-ivanti-exploitation","date":"2026-02-10"},{"url":"https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/","date":"2026-02-17"},{"url":"https://www.recordedfuture.com/blog/january-2026-cve-landscape","date":"2026-02-24"},{"url":"https://github.security.telekom.com/2026/03/ivanti-CVE-2026-1281-exploitation.html","date":"2026-03-03"},{"url":"https://blog.nviso.eu/2026/03/13/ivanti-epmm-sleeper-shells-not-so-sleepy/","date":"2026-03-13"},{"url":"https://labs.withsecure.com/publications/ivanti-epmm-exploitation","date":"2026-03-25"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/iran-linked-cyber-attacks","date":"2026-03-31"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-04-08"}],"evidenceTotal":29,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1340","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploitation of public-facing server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allowing attackers to achieve unauthenticated remote code execution","start":51,"end":118}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: injected code yields command and script execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution","start":0,"end":118}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-4936","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4936","exploited":true,"exploitedSince":"2026-01-29","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE","module":"exploit/linux/http/ivanti_epmm_rce","type":"exploit","disclosureDate":"2026-01-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_epmm_rce.rb"}],"nuclei":[{"id":"CVE-2026-1340","name":"Ivanti EPMM < 12.8.0.0 - Remote Code Execution","severity":"critical","path":"http/cves/2026/CVE-2026-1340.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1340.yaml"}],"first":{"date":"2026-01-29","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_epmm_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-01-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1340","provenance":"source"},{"date":"2026-01-29","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_epmm_rce.rb","provenance":"source"},{"date":"2026-01-29","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4936","provenance":"source"},{"date":"2026-02-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://tracker.crowdsec.net/cves/CVE-2026-1340","provenance":"source"},{"date":"2026-04-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":69},"priority":{"score":84.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 269 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}