Critical Ivanti Endpoint Manager 0-day RCE Vulnerabilities Actively Exploited in Attacks
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Two critical code-injection<\/a> vulnerabilities have been disclosed in the Endpoint Manager Mobile (EPMM) platform, which are currently being actively exploited in real-world attacks.<\/p>\n The security flaws, tracked as CVE-2026-1281 and CVE-2026-1340, allow unauthenticated attackers to execute arbitrary code remotely on vulnerable systems.<\/p>\n The vulnerabilities carry a maximum CVSS severity score of 9.8 and affect multiple versions of EPMM, including 12.5.0.0, 12.6.0.0, and 12.7.0.0.<\/p>\n According to Ivanti\u2019s security advisory published on January 29, 2026, the company is aware of a limited number of customer environments that have already been compromised at the time of disclosure.<\/p>\n Both vulnerabilities stem from code-injection weaknesses (CWE-94<\/a>) that can be exploited without authentication or user interaction.<\/p>\n The attack vector is network-based and low-complexity, enabling threat actors to compromise vulnerable EPMM<\/a> instances remotely with minimal effort.<\/p>\n Successful exploitation grants attackers complete control over the confidentiality, integrity, and availability of affected systems.<\/p>\nActive Exploitation Confirmed<\/strong><\/h2>\n