CVE-2026-1281: Ivanti Endpoint Manager Mobile code injection, unauthenticated RCE
The short version: CVE-2026-1281 is a code-injection flaw in Ivanti Endpoint Manager Mobile (EPMM) that lets an unauthenticated attacker achieve remote code execution on the server. EPMM manages your enrolled phones and tablets, so code execution there is a serious foothold. It scores 9.8 and is in CISA's KEV catalog. If you run an internet-facing EPMM, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — unauthenticated RCE on a mobile-device-management server |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~81.2% · 99.60th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-02-01 |
| Known exploited? | Yes — listed in CISA KEV |
| Vulnerability type | CWE-94 code injection → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Ivanti Endpoint Manager Mobile (EPMM) — see Ivanti's advisory for affected versions |
| Fixed in | Patched EPMM build per Ivanti's advisory (CVE-2026-1281 / CVE-2026-1340) |
What you need to know
CVE-2026-1281 lets an unauthenticated attacker inject and execute code on the EPMM server. It was disclosed alongside a companion EPMM issue (CVE-2026-1340) in the same Ivanti advisory.
Why it belongs at the top of the queue:
- It's pre-authentication and network-reachable. No credentials, no chain required.
- The target manages your mobile fleet. EPMM holds device inventory and administrative control over enrolled devices — code execution here is both a rich target and a launch point.
- It's confirmed exploited. CISA added it to KEV with a short remediation deadline, so the risk is operational, not theoretical.
How serious we see it
Critical — in practice and on paper.
Unauthenticated remote code execution on an internet-facing management server, listed in KEV, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects a specific product, the fix is published, and exposure is quick to determine. Because it's a KEV-listed flaw with a tight deadline, treat an exposed, unpatched EPMM as potentially compromised until you've verified otherwise.
Recommendations
Straight from Ivanti's advisory and CISA:
- Patch now. Apply the fixed EPMM build from Ivanti's advisory (which also addresses CVE-2026-1340).
- Hunt for compromise. Review EPMM logs for signs of exploitation and unexpected files or processes on the server.
- If compromised, respond fully. Rebuild from a known-good image and rotate all credentials, keys, and tokens the server held.
- Harden exposure. Restrict who can reach the EPMM interface; keep administrative access off the public internet.
- Confirm your exposure first. Verify whether you run an internet-facing EPMM and which version.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Ivanti EPMM interfaces, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top of your results because it's in KEV.
That continuous, attacker's-eye view is the point: when a management-server flaw breaks, the exposed EPMM is already mapped, so you go straight to patch-and-verify.