erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: January 29, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340. Every organization running on-premises Ivanti Endpoint Manager Mobile (EPMM) 12.5, 12.6 or 12.7, especially where the server is internet-facing, as it normally is for device enrollment.
  • Do you run any of these? Ivanti Endpoint Manager Mobile (EPMM). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-01.
  • PyPI: 1 critical advisory (dfir-unfurl). Check with pip-audit (or: pip show <package>).
  • Go: 1 critical advisory (github.com/siyuan-note/siyuan/kernel). Check with govulncheck ./....
  • npm: 1 critical advisory (deephas). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-1281, CVE-2026-1340

Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340

On-premises Ivanti EPMM was open to unauthenticated remote command execution, exploited before disclosure and with a public PoC a day later; patch, confirm the RPM survived any later upgrade, and hunt for compromise.

Must act: Every organization running on-premises Ivanti Endpoint Manager Mobile (EPMM) 12.5, 12.6 or 12.7, especially where the server is internet-facing, as it normally is for device enrollment.

Can relax: Organizations that don't run on-premises EPMM; this brief covers the EPMM server only.

  1. Identify every on-premises EPMM appliance and its version.
  2. Apply the Ivanti security update RPM that matches your release line, using the latest revision Ivanti lists.
  3. After any EPMM version upgrade, confirm the RPM fix is still in place or reapply it; watchTowr reports the RPM does not persist.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-1281Ivanti Endpoint Manager Mobile (EPMM)
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability		2026-02-01

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 1

Check: govulncheck ./...

npm 1

Check: npm audit (or: npm ls <package>)

PyPI 1

Check: pip-audit (or: pip show <package>)