Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
What happened
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CISA lists it as exploited, added 29 Jan 2026.
Does it affect you
Names Ivanti Connect Secure. Enter the product and version you run to place it against the affected range the vendor published.
What to do
- Apply the vendor patch named in this advisory.
forums.ivanti.com - Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
cisa.gov
CISA’s notes for this entry:
- Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please: see: forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340
- support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0S-5.noarch.rpm
- support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0L-5.noarch.rpm
- nvd.nist.gov/vuln/detail/CVE-2026-1281
Affected, as published to NVD
- ivanti-cs
- Ivanti Connect Secure: everything up to and including 12.5.0.0
The record
- NVD status
- Analyzed
- Published
- 29 Jan 2026, last modified 17 Jun 2026 (NVD)
- Severity
- CVSS 3.1 base score 9.8, Critical — computed here from the vector; NVD states 9.8.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-94 Improper Control of Generation of Code ('Code Injection') (NVD; names by MITRE)
- Exploitation
- Listed in CISA’s Known Exploited Vulnerabilities catalogue since 29 Jan 2026; federal remediation due 01 Feb 2026. CISA entry
- Exploit probability
- EPSS 98.7%, 100th percentile — FIRST, scored 23 Oct 2026. FIRST EPSS
- Vendor
- Ivanti · Endpoint Manager Mobile (EPMM) (CISA)
References on the NVD record
Sources
The verdict above is computed from the products and versions you entered and the affected ranges the vendor published to NVD. It does not inspect your environment, and this site never reports a product as unaffected: why.