Critical Zero-Days Impacting Ivanti EPMM Actively Exploited

Organizations worldwide are facing an immediate and severe security threat as two critical zero-day vulnerabilities, identified as CVE-2026-1281 and CVE-2026-1340, in Ivanti Endpoint Manager Mobile (EPMM) are reportedly under active exploitation. These vulnerabilities pose a significant risk to the integrity and confidentiality of enterprise mobile environments, necessitating urgent attention from IT and security teams.

Ivanti EPMM, formerly known as MobileIron Core, is a widely used platform for managing and securing mobile devices and applications within enterprise networks. The discovery and active exploitation of these zero-day flaws mean that threat actors have been leveraging these weaknesses before official patches were available or widely applied, granting them an advantage in compromising systems.

Understanding the Ivanti EPMM Vulnerabilities: CVE-2026-1281 and CVE-2026-1340

The vulnerabilities CVE-2026-1281 and CVE-2026-1340 have been confirmed to impact the Ivanti EPMM platform. While specific technical details regarding the exploit chain are being analyzed by security researchers, it is known that these flaws allow for unauthorized access to systems. The active exploitation of these zero-days indicates that they can be leveraged to bypass security controls, potentially leading to remote code execution or data exfiltration.

The impact of successful exploitation includes potential unauthorized administrative access to the EPMM appliance, allowing attackers to control managed devices, access sensitive corporate data, or establish persistence within the network. This level of compromise can have far-reaching consequences for business operations and data privacy.

Active Exploitation Observed: Immediate Threat to Enterprises

Security advisories confirm that both CVE-2026-1281 and CVE-2026-1340 are not merely theoretical threats but have been actively exploited in the wild. This means that malicious actors are already leveraging these vulnerabilities to target organizations utilizing Ivanti EPMM. The observation of active attacks underscores the critical need for immediate defensive measures.

Reports indicate that exploitation attempts have been detected by various security researchers and Ivanti itself. These attacks aim to establish initial access and further compromise target environments. Organizations must assume that their Ivanti EPMM instances could be targets and act decisively to mitigate potential breaches.

Urgent Action Required: Patching and Mitigation Steps

Ivanti has addressed these critical vulnerabilities by releasing security updates. Organizations running Ivanti EPMM are strongly advised to apply these patches without delay. Given the active exploitation, this is not a recommendation but an imperative step to protect corporate assets.

• Apply Patches Immediately: Prioritize and install the latest security updates released by Ivanti for all EPMM instances. Verify that the patches are successfully applied and systems are updated to the secure versions.
• Network Monitoring: Implement enhanced monitoring for any unusual activity originating from or targeting Ivanti EPMM appliances. Look for unauthorized access attempts, anomalous logins, or suspicious network traffic patterns.
• Review Access Logs: Scrutinize access logs for Ivanti EPMM for any signs of compromise or unauthorized access that may have occurred prior to patching.
• Isolate and Segment: Where feasible, network segmentation around EPMM appliances can help limit the lateral movement of attackers in case of a successful exploit.
• Incident Response Plan: Ensure your incident response plan is ready for activation and your teams are aware of the threat landscape posed by these zero-days.

The ongoing exploitation of CVE-2026-1281 and CVE-2026-1340 highlights the persistent challenge of zero-day threats. Proactive patching and robust security practices are paramount in defending against sophisticated attacks that target critical infrastructure.