CVE-2026-1340

CRITICAL9.8Remote code exec

CISA KEVPublic PoCHigh EPSS

JSON export Create alert

Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

Ivanti / Endpoint Manager Mobile12.x.1.x RPM – 12.x.1.x RPM
Ivanti / Endpoint Manager Mobile12.x.0.x RPM – 12.x.0.x RPM

Exploits & proofs of concept

nucleiIvanti EPMM < 12.8.0.0 - Remote Code Executionby 0x_Akoko

References

MISChttps://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340

Updated 17m ago · 8 sources