CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Description
CVE-2026-1340 is a CRITICAL code injection vulnerability (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM), carrying a CVSS 3.1 score of approximately 9.8. The vulnerability allows unauthenticated remote code execution on EPMM appliances through improper input handling in the map-appstore-url and map-aft-store-url scripts. Attackers have chained this vulnerability with CVE-2026-1281 to achieve persistent access, deploying web shells, reverse shells, cryptominers, and persistent backdoors on compromised appliances. All versions of Ivanti EPMM through 12.7.x are affected. Ivanti released RPM script mitigations on January 29, 2026, with a permanent fix in version 12.8.0.0. CISA added CVE-2026-1340 to the KEV catalog on April 8, 2026, with a remediation deadline of April 11, 2026 — an unusually short three-day window reflecting the severity and active exploitation. The EPSS score of 0.738 (73.8%) places this vulnerability in the highest tier of exploitation likelihood, demanding immediate action.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | <= 12.7.0.0 |
References
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1340(Third Party Advisory, US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CWE-94 describes vulnerabilities where software constructs code segments using externally-influenced input without properly neutralizing special elements that could modify the intended code syntax or behavior. Unlike command injection (CWE-78), which targets operating system commands, code injection specifically involves the generation and execution of code within the application's own runtime environment. This allows attackers to inject and execute arbitrary code in the context of the vulnerable application, inheriting its privileges and access.
In CVE-2026-1340, the Ivanti EPMM appliance fails to properly sanitize input processed by its RPM scripts (map-appstore-url and map-aft-store-url). An unauthenticated attacker can craft requests that inject arbitrary code into these script execution paths, achieving remote code execution with the privileges of the EPMM service. Because EPMM appliances typically run with elevated privileges to manage mobile device fleets, successful exploitation grants attackers broad access to the enterprise mobile management infrastructure, including the ability to deploy malware to managed devices, exfiltrate corporate data, and establish persistent footholds within the network.
Impact Analysis
CVE-2026-1340 carries a CVSS 3.1 score of approximately 9.8 (CRITICAL), reflecting the ease of exploitation and the severity of the consequences.
Confidentiality (High): Successful exploitation provides full access to the EPMM appliance, which manages enterprise mobile devices and contains sensitive configuration data, device enrollment information, corporate policies, certificates, and credentials. Attackers can exfiltrate managed device inventories, user data, and any corporate resources accessible through the mobile management platform.
Integrity (High): Attackers achieve arbitrary code execution on the EPMM appliance, enabling modification of device management policies, deployment of malicious configurations to managed mobile devices, installation of persistent backdoors, and tampering with audit logs. The integrity of the entire mobile device management infrastructure is compromised.
Availability (High): Observed exploitation campaigns have included cryptominer deployment, which degrades appliance performance, and persistent backdoors that can be used to disrupt EPMM services at will. Incident response and remediation efforts, including appliance rebuilds and certificate rotation, cause significant operational disruption to mobile device management.
Exploitation Context: The unauthenticated, network-accessible nature of this vulnerability combined with an EPSS score of 0.738 (73.8%) indicates widespread, active exploitation. Threat actors are chaining CVE-2026-1340 with CVE-2026-1281 to maximize impact, deploying multiple payload types including web shells for persistent access and cryptominers for financial gain.
Exploit Maturity
Active Exploitation: CVE-2026-1340 is under widespread active exploitation in the wild. CISA added it to the KEV catalog on April 8, 2026, with an exceptionally short remediation deadline of April 11, 2026 (three days), signaling extreme urgency. Multiple threat actors have been observed exploiting this vulnerability independently.
Exploitation Techniques: Attackers are chaining CVE-2026-1340 with CVE-2026-1281 to achieve unauthenticated remote code execution on Ivanti EPMM appliances. Post-exploitation activity includes web shell deployment for persistent interactive access, reverse shell connections to attacker-controlled command and control infrastructure, cryptominer installation for financial gain, and persistent backdoor mechanisms that survive reboots and basic remediation attempts.
EPSS Context: The EPSS score of 0.738 (73.8%) is exceptionally high, placing this vulnerability among the most actively exploited vulnerabilities tracked. This score reflects confirmed mass exploitation across internet-facing EPMM appliances.
Ransomware Association: While the CISA KEV entry does not directly associate CVE-2026-1340 with ransomware campaigns, the persistent backdoor capabilities observed in exploitation campaigns provide a ready path for ransomware deployment. Organizations should treat any compromised EPMM appliance as a potential staging point for broader network attacks.
Attack Surface: Ivanti EPMM appliances are typically internet-facing to manage mobile device enrollment and policy distribution, making them directly accessible to remote attackers without requiring any internal network access.
Remediation
-
Apply the permanent fix immediately. Upgrade all Ivanti EPMM appliances to version 12.8.0.0 or later, which contains the permanent fix for CVE-2026-1340. If upgrading is not immediately possible, apply the RPM script mitigations released on January 29, 2026, as an interim measure. Consult Ivanti's security advisory for specific upgrade instructions.
-
Scan for indicators of compromise before and after patching. Given the widespread active exploitation, assume compromise on any unpatched EPMM appliance. Check for web shells in web-accessible directories, unexpected cron jobs or systemd services, unauthorized SSH keys, unusual outbound network connections (reverse shells, cryptominer traffic), and elevated CPU usage indicating cryptominer activity. Review access logs for exploitation patterns targeting the map-appstore-url and map-aft-store-url endpoints.
-
Isolate compromised appliances and perform forensic analysis. If indicators of compromise are found, immediately isolate the appliance from the network. Conduct forensic analysis to determine the scope of the breach, including whether managed mobile devices received malicious policies or configurations, and whether lateral movement into the broader network occurred.
-
Rotate all credentials accessible to the EPMM appliance. This includes LDAP/Active Directory service account credentials, certificates used for device enrollment and management, API keys for integrated services, and database credentials. Assume any credential stored on or accessible to a compromised appliance has been exfiltrated.
-
Review managed device fleet integrity. Verify that no unauthorized profiles, certificates, or configurations were pushed to managed mobile devices. Check device enrollment records for anomalies and consider re-enrolling devices if compromise of the management infrastructure is confirmed.
-
Restrict network exposure of EPMM appliances. Place EPMM appliances behind a web application firewall or reverse proxy with strict request filtering. Limit administrative interface access to trusted networks only. Implement network monitoring for anomalous traffic patterns to and from the appliance.
Technical Details
CVE-2026-1340 is a CRITICAL code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM), exploitable by unauthenticated remote attackers over the network.
CVSS 3.1 Vector Analysis: The approximate CVSS score of 9.8 reflects Attack Vector (Network), Attack Complexity (Low), Privileges Required (None), User Interaction (None), Scope (Unchanged), and Confidentiality/Integrity/Availability impacts all rated High. The combination of unauthenticated access, low complexity, and no user interaction makes this a trivially exploitable vulnerability.
Vulnerability Mechanism: The vulnerability exists in the RPM script processing within Ivanti EPMM, specifically in the map-appstore-url and map-aft-store-url script components. These scripts fail to properly neutralize externally-supplied input before incorporating it into code that is subsequently executed. An attacker can craft HTTP requests to the EPMM appliance that inject arbitrary code into the script execution context, achieving code execution with the privileges of the EPMM application.
Exploit Chain: In observed attacks, CVE-2026-1340 is chained with CVE-2026-1281 to maximize exploitation impact. The chain enables unauthenticated remote access followed by privilege escalation and persistent code execution on the target appliance. The exact interplay between the two vulnerabilities involves using one to gain initial code execution and the other to escalate privileges or bypass additional security controls.
Post-Exploitation Behavior: Threat actors have been observed deploying multiple payload types after successful exploitation: web shells placed in web-accessible directories for persistent browser-based access, reverse shell payloads connecting to external C2 servers, XMRig and similar cryptominer binaries for Monero mining, and persistence mechanisms including cron jobs and modified system services to survive reboots.
Affected Versions: All Ivanti EPMM versions through 12.7.x are vulnerable. The RPM script mitigation released January 29, 2026, addresses the immediate attack vector, while version 12.8.0.0 provides a comprehensive architectural fix.
Frequently Asked Questions
What is CVE-2026-1340?
CVE-2026-1340 is a critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows unauthenticated remote attackers to execute arbitrary code on EPMM appliances. It is being actively exploited in the wild, with attackers deploying web shells, reverse shells, cryptominers, and persistent backdoors. CISA added it to the KEV catalog on April 8, 2026, with a three-day remediation deadline.
Which versions of Ivanti EPMM are affected?
All versions of Ivanti EPMM through 12.7.x are vulnerable. Ivanti released RPM script mitigations on January 29, 2026, and a permanent fix in version 12.8.0.0. Organizations should upgrade to 12.8.0.0 or later as soon as possible.
What is the relationship between CVE-2026-1340 and CVE-2026-1281?
Attackers are chaining CVE-2026-1340 with CVE-2026-1281 to achieve full unauthenticated remote code execution on EPMM appliances. Both vulnerabilities target script components within the EPMM platform and should be remediated together. Upgrading to EPMM 12.8.0.0 addresses both issues.
How do I know if my EPMM appliance has been compromised?
Check for web shells in web-accessible directories, unexpected cron jobs or systemd services, unauthorized SSH keys, unusual outbound network connections, and elevated CPU usage from cryptominer activity. Review EPMM access logs for suspicious requests targeting the map-appstore-url and map-aft-store-url endpoints. Given the widespread exploitation, assume compromise on any unpatched appliance and conduct a thorough forensic investigation.
Why is the KEV remediation deadline only three days?
CISA set an unusually short three-day remediation deadline (April 8 to April 11, 2026) due to the combination of active mass exploitation, unauthenticated remote attack vector, critical severity, and the availability of a permanent fix. This reflects the extreme urgency of the situation and the immediate risk to organizations running unpatched EPMM appliances.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.