erroneo.us
Search all guides⌘K

Security Digest · Jan 29, 2026 · Vulnerability · Mobile

Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340

Two unauthenticated code-injection bugs in Ivanti EPMM, exploited as a zero-day and in CISA KEV. Fixed by RPM patches that need reapplying. Patch and hunt.

Published By erroneo.us Security Desk · Updated 3 min read8 sources

Our verdict

Act now

On-premises Ivanti EPMM was open to unauthenticated remote command execution, exploited before disclosure and with a public PoC a day later; patch, confirm the RPM survived any later upgrade, and hunt for compromise.

Who must act: Every organization running on-premises Ivanti Endpoint Manager Mobile (EPMM) 12.5, 12.6 or 12.7, especially where the server is internet-facing, as it normally is for device enrollment.

Who can relax: Organizations that don't run on-premises EPMM; this brief covers the EPMM server only.

Affected
Ivanti EPMM 12.7.0.0 and earlier on the 12.x.0.x line
Ivanti EPMM 12.6.1.0 and earlier on the 12.x.1.x line
Versions 12.5.0.0, 12.5.1.0, 12.6.0.0 per the vendor's patch mapping
Fixed in
RPM ivanti-security-update-1761642 (12.x.0.x: ...-1.0.0S-5; 12.x.1.x: ...-1.0.0L-5), January 2026
Updated RPMs ...-1.1.0S-5 / ...-1.1.0L-5 referenced by CISA in April 2026
A permanent fix in a later EPMM release (watchTowr reported 12.8.0.0 planned for Q1 2026); check Ivanti's advisory
CVSS
9.8 (v3.1, vendor)
EPSS
98.7% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Identify every on-premises EPMM appliance and its version.
  2. Apply the Ivanti security update RPM that matches your release line, using the latest revision Ivanti lists.
  3. After any EPMM version upgrade, confirm the RPM fix is still in place or reapply it; watchTowr reports the RPM does not persist.
  4. Run the vendor's log regex over Apache access logs to look for exploitation, and follow Ivanti's analysis guidance.
  5. If exploitation is suspected, rebuild the appliance from a clean state and rotate credentials and integrations it stores (LDAP, certificates, API accounts).

How to check if you are affected or compromised

  • grep Apache/HTTPD access logs with the vendor regex ^.*\/mifs\/c\/\(aft\|app\)store.*theValue\?\?.* (Rapid7's copy).
  • Look for GET requests to /mifs/c/appstore/fob/ or /mifs/c/aftstore/fob/ containing backticks, gPath[ or unusual st=theValue fields.
  • Look for unexpected processes, web shells or outbound connections from the EPMM appliance since late January 2026.

What happened#

On January 29, 2026, Ivanti disclosed two code-injection vulnerabilities (CWE-94) in on-premises Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340. Both allow unauthenticated remote code execution and are scored CVSS 3.1 9.8. According to Rapid7, Ivanti said exploitation had occurred before disclosure. CISA added CVE-2026-1281 to KEV the same day with a three-day deadline (February 1). It added CVE-2026-1340 on April 8, 2026.

The bugs sit in the URL handling for two features, In-House Application Distribution (/mifs/c/appstore/fob/) and Android File Transfer Configuration (/mifs/c/aftstore/fob/). watchTowr showed that Apache RewriteMap entries passed request data to Bash scripts (map-appstore-url, map-aft-store-url). A crafted GET request could get shell commands executed through Bash arithmetic expansion. watchTowr published a working proof of concept on January 30.

Who is affected#

The affected product is on-premises Ivanti EPMM, formerly MobileIron Core. Rapid7, citing Ivanti, says versions 12.7.0.0, 12.6.0.0 and 12.5.0.0 and earlier take the 12.x.0.x RPM, and 12.6.1.0 and 12.5.1.0 and earlier take the 12.x.1.x RPM. EPMM servers usually face the internet so phones can enroll and fetch apps, which makes these endpoints reachable by design. A compromised MDM server can expose user names, email addresses, phone numbers, device location and identifiers, and it gives the attacker a privileged foothold for lateral movement.

Do you really need to act?#

Yes, if you run on-premises EPMM. The flaws were exploited as a zero-day, a public exploit appeared within a day, and no login is needed. EPMM has a track record here: Rapid7 notes earlier in-the-wild exploitation via CVE-2023-35078 and via the CVE-2025-4427/4428 chain.

The fix itself also needs checking. Ivanti shipped it as an RPM (ivanti-security-update-1761642-1.0.0S-5 / -1.0.0L-5), not as a new release. watchTowr reported that the RPM has to be reapplied after later changes such as version upgrades, and that Ivanti planned a permanent fix in 12.8.0.0 for Q1 2026. CISA's April KEV entry points to revised packages (-1.1.0S-5 / -1.1.0L-5). A server patched in January may not be patched now. Check which build and RPM revision Ivanti's advisory currently recommends.

What to do now#

  1. Inventory every EPMM appliance and record its version and installed security RPMs.
  2. Install the latest security update RPM for your line (12.x.0.x or 12.x.1.x) as Ivanti lists it, or move to a release Ivanti says includes the permanent fix.
  3. After any upgrade, verify the fix is still present. watchTowr notes the patch replaces the Bash RewriteMap scripts with Java classes (AppStoreUrlMapper, AFTUrlMapper) in the HTTPD config.
  4. Hunt with the vendor regex below, and work through Ivanti's analysis guidance.
  5. If you find signs of exploitation, rebuild rather than clean in place, and rotate the directory, certificate and API credentials the server held.

How to tell if you were hit#

Ivanti's regex for HTTPD access logs, as published by Rapid7 (updated March 19, 2026), is ^.*\/mifs\/c\/\(aft\|app\)store.*theValue\?\?.*. Look for GET requests to /mifs/c/appstore/fob/ or /mifs/c/aftstore/fob/ containing st=theValue, gPath[, backticks or URL-encoded shell syntax. watchTowr's test payload used sleep 5. Logs on a compromised appliance can be tampered with, so also check for unexpected files and processes, and review network telemetry for outbound connections from the EPMM server since late January 2026.

Timeline#

  • — Ivanti discloses both CVEs and says exploitation preceded disclosure. CISA adds CVE-2026-1281 to KEV (due Feb 1).
  • — watchTowr publishes its root-cause analysis and PoC, and Rapid7 publishes its analysis.
  • — Rapid7 updates the hunting regex based on new information from Ivanti.
  • — CISA adds CVE-2026-1340 to KEV and references updated 1.1.0 RPMs.

Vulnerability records

  • CVE-2026-1281 · KEV 2026-01-29 · A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
  • CVE-2026-1340 · KEV 2026-04-08 · A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Ivanti — Security Advisory: EPMM CVE-2026-1281 & CVE-2026-1340 forums.ivanti.com
  2. Ivanti — Analysis Guidance: EPMM CVE-2026-1281 & CVE-2026-1340 forums.ivanti.com
  3. NVD — CVE-2026-1281 nvd.nist.gov
  4. NVD — CVE-2026-1340 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2026-1281 cisa.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2026-1340 cisa.gov
  7. Rapid7 — Critical Ivanti EPMM zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340) rapid7.com
  8. watchTowr Labs — Someone Knows Bash Far Too Well (Ivanti EPMM pre-auth RCEs) labs.watchtowr.com