Ivanti EPMM Faces Active Attacks as Two Critical Zero-Day Vulnerabilities Exploit Administrators

In a stark reminder of how high-value network management tools are prime targets, Ivanti Endpoint Manager Mobile (EPMM) is under active attack due to two newly discovered zero-day vulnerabilities. These flaws allow attackers to execute malicious code remotely without authentication, putting sensitive mobile device management systems at risk. While Ivanti has issued patches and temporary fixes, the vulnerabilities highlight ongoing challenges for organizations relying on network edge solutions.

Summary of the Threat

Two critical zero-day vulnerabilities—CVE-2026-1281 and CVE-2026-1340—have been actively exploited in Ivanti EPMM. Both carry a CVSS score of 9.8, indicating extreme severity. These vulnerabilities allow unauthenticated remote code execution, giving attackers control over devices and applications managed through Ivanti’s platform. Although Ivanti did not confirm when the earliest exploitation occurred, it acknowledged a “very limited number of customers” were impacted before disclosure.

This isn’t the first time Ivanti has faced targeted attacks. Since late 2021, the Cybersecurity and Infrastructure Security Agency (CISA) has cataloged 31 Ivanti defects as actively exploited, with at least 19 being used in the past two years alone. While CVE-2026-1281 has been added to the catalog, CVE-2026-1340 has not, although both are confirmed exploited individually. Notably, attackers have not yet chained the two vulnerabilities for combined exploitation.

Recent exploitation patterns show attackers are increasingly focused on EPMM. A similar pair of vulnerabilities in this product was disclosed in May 2025. Experts warn of a familiar trajectory: limited initial attacks often escalate into widespread exploitation once exploit code becomes public. Shadowserver reports more than 1,400 Ivanti EPMM instances remain exposed online, with at least 13 sources actively attempting to exploit CVE-2026-1281.

Security experts stress that exposure does not guarantee compromise, but organizations with vulnerable instances accessible over the internet should act as if already breached. Ivanti has released temporary patches for on-premises customers, which can be applied quickly without downtime. Permanent fixes are planned for future updates, though no release date has been confirmed.

Analysts note that the root cause of these vulnerabilities stems from “blurred lines between attacker input and trusted code,” allowing attackers to inject malicious payloads. The issue is part of a long-standing pattern: Ivanti products have been repeatedly targeted by threat actors, including state-sponsored groups. While these vulnerabilities are complex and difficult to detect before exploitation, security experts emphasize that defensive engineering must anticipate non-obvious attack paths.

What Undercode Say:

The new Ivanti zero-days underscore a recurring challenge in enterprise network management: sophisticated attackers consistently exploit subtle flaws in widely used software before vendors can respond. These EPMM vulnerabilities, while nuanced and non-obvious, illustrate that even well-established security products are not immune to high-severity flaws.

Attackers are drawn to network edge solutions like Ivanti EPMM because these platforms control critical endpoints and applications. The consequences of a successful breach are significant: attackers can manipulate device policies, deploy malicious software, and potentially pivot deeper into corporate networks. The rapid emergence of public exploit code following disclosure further magnifies this risk.

The trajectory observed here reflects a broader cybersecurity reality: once zero-days are publicly disclosed, opportunistic attackers often escalate attacks to mass exploitation in days or weeks. This pattern has been documented across Ivanti’s portfolio, with CVE-2025-4428 and other EPMM vulnerabilities previously exploited by state-sponsored and financially motivated threat actors.

From a defensive standpoint, organizations must treat every exposed zero-day as a live threat. Patching, network segmentation, and incident response readiness are crucial. Temporary patches, while helpful, are not a substitute for permanent updates or robust monitoring of network edge devices. Security teams should proactively hunt for vulnerabilities that blur the line between trusted code and attacker input.

Moreover, Ivanti’s situation highlights the human factor in security engineering. Detecting nuanced, low-surface-area vulnerabilities requires specialized expertise and aggressive code auditing. As Ryan Emmons of Rapid7 notes, the known exploit patterns now provide a roadmap for defenders to identify similar flaws before attackers do. Organizations leveraging Ivanti or similar tools should anticipate ongoing attempts to exploit even minor weaknesses.

The broader lesson extends beyond Ivanti: enterprise-grade network tools are lucrative targets. Attackers will continue to probe and exploit subtle flaws, and vendors must evolve security processes to anticipate both obvious and non-obvious attack paths. Defensive engineering cannot rely on obscurity; proactive monitoring and rapid patching cycles are critical.

In conclusion, the Ivanti EPMM zero-days reflect a predictable but dangerous cycle: discovery, limited exploitation, disclosure, and rapid mass exploitation. Organizations must adopt an assume-compromised mindset for exposed systems, and vendors need to integrate proactive threat intelligence into product development to mitigate these high-stakes vulnerabilities.

Fact Checker Results:

✅ CVE Details Verified – CVE-2026-1281 and CVE-2026-1340 are confirmed zero-day vulnerabilities affecting Ivanti EPMM.
✅ Active Exploitation Confirmed – Reports from Shadowserver and cybersecurity agencies corroborate exploitation attempts.
❌ Customer Impact Numbers Unknown – Ivanti has not disclosed the exact number of affected customers.

Prediction:

⚠️ Expect a surge in global exploitation attempts over the next few weeks as public proof-of-concept scripts circulate.
⚠️ Organizations failing to patch quickly will face elevated risk of compromise and potential lateral network attacks.
✅ Vendors like Ivanti will likely accelerate permanent patch releases, but attackers will continue targeting similar network edge platforms, keeping the cycle of discovery and exploitation ongoing.

If you want, I can also create a diagram showing the exploit workflow and attack vector for CVE-2026-1281 and CVE-2026-1340 to make this article visually more compelling. Do you want me to do that?