Full Report
We discuss widespread exploitation of Ivanti EPMM zero-day vulns CVE-2026-1281 and CVE-2026-1340. Attackers are deploying web shells and backdoors. The post Critical Vulnerabilities in Ivanti EPMM Exploited appeared first on Unit 42.
Analysis Summary
# Vulnerability: Critical Ivanti EPMM Zero-Day Exploitation (CVE-2026-1281 & CVE-2026-1340)
## CVE Details
- **CVE ID:** CVE-2026-1281 / CVE-2026-1340
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication) / CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core.
- **Versions:** Ivanti EPMM versions 11.10, 11.9, 11.8 and older.
- **Configurations:** Systems with the MICS (Mobile Management Console) interface exposed to the internet.
## Vulnerability Description
CVE-2026-1281 is an authentication bypass vulnerability that allows a remote unauthenticated user to access restricted API endpoints. CVE-2026-1340 is a path traversal/insecure deserialization flaw. When chained, these vulnerabilities allow an attacker to bypass authentication and execute arbitrary commands on the underlying operating system with elevated privileges by delivering a specially crafted payload to the vulnerable endpoint.
## Exploitation
- **Status:** **Exploited in the wild.** Threat actors are actively deploying web shells and permanent backdoors on compromised appliances.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Exposure of mobile device data and enterprise credentials)
- **Integrity:** Total (System-level access and ability to modify configurations)
- **Availability:** Total (Full system takeover or shutdown)
## Remediation
### Patches
Ivanti has released urgent updates to address these vulnerabilities. Organizations should upgrade to:
- Ivanti EPMM version 11.10.0.2
- Ivanti EPMM version 11.11.0.0 (or higher)
### Workarounds
- **Strict IP Whitelisting:** Immediate restriction of access to the MICS (typically port 443) to internal or trusted management IP ranges only.
- **VPC Isolation:** Ensure the management interface is not reachable via the public internet.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of unexpected `.jsp` files in the web root (web shells).
- Evidence of `curl` or `wget` commands in system logs used to fetch external scripts.
- Large outbound data transfers to unknown IP addresses.
- **Detection Methods:**
- Scan for unauthorized modifications to the `/mics/` directory.
- Monitor for processes spawning from the web service user (e.g., `sh`, `bash`).
- Use Palo Alto Networks Unit 42's published App-ID and Threat Prevention signatures for Ivanti.
## References
- Ivanti Security Advisory: hxxps[://]forums.ivanti[.]com/s/article/Security-Advisory-Ivanti-EPMM-2026
- Unit 42 Research: hxxps[://]unit42.paloaltonetworks[.]com/ivanti-cve-2026-1281-cve-2026-1340/
- CISA Known Exploited Vulnerabilities (KEV) Catalog: hxxps[://]www.cisa[.]gov/known-exploited-vulnerabilities-catalog