Actively exploited in the wild
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti - Endpoint Manager Mobile (EPMM) · Listed in the CISA KEV since 2026-01-29. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-1281
CriticalCVSS 9.8KEVSummary
Code injection vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Risk Assessment
An attacker can remotely execute arbitrary code without authentication, potentially leading to full compromise of the mobile device management system.
Recommendation
It is recommended to immediately update Ivanti Endpoint Manager Mobile to the latest version that includes security fixes. Also, restrict network access to the system.
Other vulnerabilities in Ivanti Endpoint Manager Mobile
See all- CVE-2025-4428HighActively exploited
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
- CVE-2025-4427MediumActively exploited
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
- CVE-2026-18851High
Missing authorization in Ivanti Endpoint Manager Mobile before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.
Original NVD description (English source)
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.