Organizations utilizing Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, are facing a critical security situation. Two zero-day vulnerabilities, identified as CVE-2026-1281 and CVE-2026-1340, have been confirmed to be under active exploitation. This development necessitates immediate attention from IT and security teams to protect their environments.

The active exploitation of these vulnerabilities poses a significant risk, allowing unauthorized actors to potentially compromise systems that rely on Ivanti EPMM for managing mobile devices. A zero-day vulnerability refers to a flaw that is unknown to the vendor and therefore unpatched, making it particularly dangerous when actively exploited in the wild.

Understanding the Critical Threats: CVE-2026-1281 and CVE-2026-1340

The two vulnerabilities, CVE-2026-1281 and CVE-2026-1340, impact Ivanti Endpoint Manager Mobile (EPMM) deployments. These are not theoretical risks but actual threats currently being leveraged by malicious actors. The details surrounding the exact nature of the exploitation vectors highlight the severity of these flaws, as they enable attackers to bypass security measures and gain illicit access to sensitive data and systems.

The classification as zero-day exploits underscores the urgency for affected organizations. Without an immediate patch available at the time of discovery, defenders must rely on proactive monitoring and mitigation strategies until official fixes are released and applied. The threat actors are specifically targeting weaknesses within the EPMM platform, aiming to achieve persistent access and further network compromise.

Impact and Immediate Response for Organizations

The successful exploitation of CVE-2026-1281 and CVE-2026-1340 can lead to severe consequences, including unauthorized access to corporate networks, data exfiltration, and potential disruption of mobile device management operations. Organizations using Ivanti EPMM should assume their systems are at risk and prioritize defensive actions.

It is imperative for IT security personnel to take prompt and decisive measures to mitigate the threat. Ivanti has acknowledged these vulnerabilities and is working on providing official guidance and patches. Remaining vigilant and implementing temporary workarounds where possible is crucial during this period of active exploitation.

Recommended Actions to Secure Ivanti EPMM Deployments

To safeguard against the ongoing exploitation of CVE-2026-1281 and CVE-2026-1340, organizations should take the following steps immediately:

• Monitor official Ivanti security advisories and knowledge base articles for the latest information and any released patches or mitigation scripts.
• Apply all available patches and updates to Ivanti EPMM instances as soon as they are released and thoroughly tested in a staging environment.
• Scrutinize network logs and Ivanti EPMM access logs for any indicators of compromise or unusual activity, particularly focusing on authentication attempts and administrative actions.
• Implement stringent network segmentation to limit the potential blast radius should a compromise occur.
• Review and strengthen access controls for Ivanti EPMM administrators and users.
• Consider isolating Ivanti EPMM instances from direct internet exposure or implementing strong web application firewall (WAF) rules as a temporary protective measure.

Proactive threat hunting and incident response capabilities are essential in identifying and containing any potential breaches related to these zero-day vulnerabilities. Staying informed and acting swiftly are key to maintaining a strong security posture against evolving threats.