CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Description
CVE-2026-1281 is a critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that enables unauthenticated remote code execution. With a CVSS v3.1 base score of 9.8, the flaw allows a network attacker without any credentials to inject and execute arbitrary code on the EPMM server, gaining full control of the mobile device management infrastructure. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 1, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 57.41% at the 98.1st percentile places this among the most aggressively exploited vulnerabilities in the current threat landscape, confirming that the majority of exposed EPMM instances are facing active exploitation attempts. Affected versions include EPMM 12.5.0.0 and earlier, 12.5.1.0, 12.6.0.0, 12.6.1.0, and 12.7.0.0.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | <= 12.5.0.0; 12.5.1.0; 12.6.0.0; 12.6.1.0; 12.7.0.0 |
References
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2026-1281 is classified under CWE-94 (Code Injection). This weakness occurs when software allows user-controlled input to be incorporated into dynamically generated code that is subsequently executed, without adequately validating or sanitizing the input. In Ivanti EPMM, the application processes externally supplied data through an interface that constructs and executes code at runtime. An attacker can inject malicious code statements into this input, which the application then executes with the privileges of the EPMM server process. Code injection differs from OS command injection in that the injected payload is interpreted by the application's own runtime environment rather than an operating system shell, but the end result is the same: arbitrary code execution on the server. The pre-authentication nature of this vulnerability in a mobile device management platform is exceptionally dangerous because MDM servers maintain control channels to all enrolled mobile devices. Learn more about CWE-94
Impact Analysis
The impact of CVE-2026-1281 is catastrophic across all dimensions of the CIA triad, amplified by the strategic position of mobile device management infrastructure in enterprise environments. Confidentiality is completely compromised because EPMM manages and controls mobile devices across the organization, storing device inventories, user credentials, Wi-Fi and VPN configurations, email profiles, device certificates, application management policies, and potentially the ability to retrieve data from enrolled devices. An attacker who compromises the EPMM server gains access to the complete mobile fleet's configuration data and can potentially push commands to enrolled devices to exfiltrate their contents.
Integrity suffers maximum impact as the attacker can modify device management policies, push malicious configurations to enrolled mobile devices, deploy unauthorized applications, alter compliance policies, and create backdoor administrative accounts. The MDM server's trust relationship with managed devices means that policy changes pushed from the compromised server will be automatically applied by devices, enabling the attacker to silently reconfigure thousands of mobile devices to lower their security posture, install surveillance software, or redirect network traffic through attacker-controlled infrastructure.
Availability faces critical risk because the attacker can disrupt mobile device management operations, wipe enrolled devices, lock users out of their devices, or deploy destructive payloads across the managed fleet. The EPSS score of 57.41% at the 98.1st percentile confirms that more than half of exposed instances face exploitation attempts. Ivanti products have been repeatedly targeted by sophisticated threat actors including state-sponsored groups, and EPMM vulnerabilities have a documented history of exploitation in high-profile attacks. The ransomware association is unknown, but the infrastructure-level access achieved through exploitation enables both targeted espionage and widespread ransomware deployment across managed devices.
Exploit Maturity
CVE-2026-1281 exhibits very high exploit maturity with confirmed active exploitation and a documented history of Ivanti product targeting. The EPSS score of 57.41% at the 98.1st percentile means that more than half of exposed EPMM instances face exploitation attempts, placing this among the top 2% of all tracked vulnerabilities. CISA's KEV listing with a remediation deadline of February 1, 2026 confirms sustained real-world exploitation. The official Ivanti security advisory is available at Ivanti EPMM Security Advisory, which also references a related vulnerability CVE-2026-1340.
Ivanti EPMM (formerly MobileIron Core) has a well-documented history of being targeted by sophisticated threat actors. Previous EPMM vulnerabilities, notably CVE-2023-35078 and CVE-2023-35081, were exploited in high-profile attacks against government organizations. This pattern of targeting means that exploit development for new EPMM vulnerabilities proceeds rapidly once disclosed, as threat actors maintain familiarity with the product's architecture and attack surface. The pre-authentication code injection vector requires no credentials and is exploitable through network requests, making it readily automatable. The combination of critical infrastructure positioning, historical targeting patterns, and trivial exploitation complexity explains the exceptionally high EPSS score.
Remediation
-
Apply the Ivanti security patch immediately for all affected EPMM versions. Consult the Ivanti Security Advisory for specific patch versions and installation instructions. Given the 57.41% EPSS score, any exposed EPMM instance that remains unpatched faces probable exploitation within a short timeframe. Also address the related vulnerability CVE-2026-1340 referenced in the same advisory.
-
Restrict network access to the EPMM server as an emergency compensating control. The EPMM administrative interface should only be accessible from trusted management networks. While the device enrollment and management ports must remain accessible to managed devices, implement network segmentation to separate the administrative interface from general network access. Consider placing the EPMM server behind a WAF that can filter malicious payloads targeting the code injection endpoint.
-
Conduct an immediate forensic investigation of any EPMM server running an affected version. Review EPMM application logs for suspicious authentication events and API calls, check the server for unauthorized files, processes, and scheduled tasks, examine outbound network connections for command-and-control communications, and verify that the EPMM configuration and managed device policies have not been tampered with.
-
Audit enrolled device configurations by reviewing the policies and profiles currently deployed to managed devices. Verify that no unauthorized applications have been pushed, no malicious Wi-Fi or VPN profiles have been deployed, and no device management commands (such as remote wipe or lock) have been issued without authorization. Compare current device configurations against known-good baselines.
-
Rotate all credentials and certificates managed by the EPMM server after patching. This includes EPMM administrator credentials, LDAP/AD service account credentials, device enrollment certificates, SCEP and certificate authority integration credentials, and any API keys used for integrations with other systems. Revoke and reissue device certificates if the EPMM certificate authority may have been compromised.
Technical Details
CVE-2026-1281 is a code injection vulnerability in Ivanti Endpoint Manager Mobile, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. All vector components indicate maximum exploitability: Attack Vector (AV:N) confirms remote network exploitation. Attack Complexity (AC:L) means the exploit works reliably without special conditions. Privileges Required (PR:N) indicates no authentication is needed. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) keeps impact within the EPMM process context, but this process has extensive privileges including mobile device management capabilities and database access.
The code injection vulnerability allows an attacker to submit crafted input to an EPMM endpoint that is processed by the application's code generation or evaluation mechanism. Unlike OS command injection where the payload is executed by the operating system shell, code injection targets the application's own runtime environment, which in EPMM's case provides direct access to the application's internal objects, database connections, and management functions. The attacker's injected code executes with the full privileges of the EPMM application process, which includes the ability to interact with the MDM database, push policies to managed devices, and execute operating system commands through the application framework.
The affected versions include EPMM 12.5.0.0 and earlier, 12.5.1.0, 12.6.0.0, 12.6.1.0, and 12.7.0.0. The EPMM server typically runs on a Linux-based appliance with the application process having broad system permissions for device management operations. The Ivanti advisory references both CVE-2026-1281 and CVE-2026-1340, suggesting that the code injection may be part of a broader vulnerability surface that includes multiple attack paths. The patch addresses the root cause by implementing proper input validation and preventing user-supplied data from being incorporated into executable code paths.
Frequently Asked Questions
What is CVE-2026-1281?
CVE-2026-1281 is a critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows unauthenticated remote attackers to execute arbitrary code on the MDM server. With a CVSS score of 9.8 and an EPSS score of 57.41%, it is among the most actively exploited vulnerabilities currently tracked.
Why are Ivanti EPMM vulnerabilities particularly dangerous?
EPMM (formerly MobileIron Core) is a mobile device management platform that maintains control over all enrolled mobile devices in an organization. Compromising the MDM server gives an attacker the ability to push configurations, deploy applications, and issue commands to every managed device, potentially affecting thousands of users simultaneously.
Which EPMM versions are affected?
EPMM versions 12.5.0.0 and earlier, 12.5.1.0, 12.6.0.0, 12.6.1.0, and 12.7.0.0 are affected. Organizations should apply the patch referenced in Ivanti's security advisory immediately.
Is there a related vulnerability I should also patch?
Yes, the Ivanti security advisory also addresses CVE-2026-1340 alongside CVE-2026-1281. Both vulnerabilities should be patched simultaneously to ensure complete remediation of the identified attack surface.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.