Ivanti confirms two Endpoint Manager Mobile zero-days exploited in attacks

Ivanti on Jan. 29, 2026, disclosed two critical vulnerabilities in its Endpoint Manager Mobile (EPMM) platform that attackers had exploited as zero-days. Both flaws, CVE-2026-1281 and CVE-2026-1340, are code injection bugs that let an unauthenticated attacker run code on the server remotely. Ivanti rated each 9.8 out of 10.

EPMM, formerly MobileIron Core, manages fleets of corporate phones and tablets. A compromised server can expose device inventories, user identities and the policies that govern mobile access to corporate systems, which makes it a valuable target for espionage and criminal groups alike.

What happened

CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities catalogue the day Ivanti published its advisory, and added CVE-2026-1340 on April 8. The Canadian Centre for Cyber Security published advisory AV26-068 the same day and later updated it to note that Ivanti has stated both flaws were exploited in the wild.

The Cyber Centre listed affected EPMM releases as 12.5.0.0 and prior, 12.6.0.0 and prior, 12.7.0.0 and prior, and 12.5.1.0 and 12.6.1.0 and prior. Ivanti also published analysis guidance to help administrators look for signs of compromise.

BleepingComputer reported on the zero-day disclosure the same day. In mid-February, the outlet reported that threat intelligence linked most of the active exploitation of the two flaws to a single actor.

Why it matters

This is not the first time EPMM has been hit. Ivanti's mobile and VPN products have been repeat targets in recent years, and CISA's catalogue now lists dozens of Ivanti flaws as exploited. Mobile device management servers are often reachable from the internet so that phones can check in, which widens exposure.

Patching alone may not be enough. An attacker who gained code execution before the update could have stolen credentials or left behind access that survives the fix, which is why Ivanti published separate guidance for checking servers.

What we don't know yet

Ivanti has not publicly said how many customers were compromised. The Cyber Centre did not report Canadian victims.

What to do

• Apply the fixes in Ivanti's EPMM security advisory for CVE-2026-1281 and CVE-2026-1340 immediately.
• Follow Ivanti's analysis guidance to check for signs of compromise, since patching does not remove an attacker who is already inside.
• Limit internet exposure of the EPMM administrative portal.