---
title: "Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340"
url: https://erroneo.us/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/
description: "Two unauthenticated code-injection bugs in Ivanti EPMM, exploited as a zero-day and in CISA KEV. Fixed by RPM patches that need reapplying. Patch and hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-01-29
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-1281", "CVE-2026-1340"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Ivanti EPMM Zero-Day RCE: CVE-2026-1281 and CVE-2026-1340

**Verdict: Act now.** On-premises Ivanti EPMM was open to unauthenticated remote command execution, exploited before disclosure and with a public PoC a day later; patch, confirm the RPM survived any later upgrade, and hunt for compromise.

- **Who must act:** Every organization running on-premises Ivanti Endpoint Manager Mobile (EPMM) 12.5, 12.6 or 12.7, especially where the server is internet-facing, as it normally is for device enrollment.
- **Who can relax:** Organizations that don't run on-premises EPMM; this brief covers the EPMM server only.
- **Affected:** Ivanti EPMM 12.7.0.0 and earlier on the 12.x.0.x line; Ivanti EPMM 12.6.1.0 and earlier on the 12.x.1.x line; Versions 12.5.0.0, 12.5.1.0, 12.6.0.0 per the vendor's patch mapping
- **Fixed:** RPM ivanti-security-update-1761642 (12.x.0.x: ...-1.0.0S-5; 12.x.1.x: ...-1.0.0L-5), January 2026; Updated RPMs ...-1.1.0S-5 / ...-1.1.0L-5 referenced by CISA in April 2026; A permanent fix in a later EPMM release (watchTowr reported 12.8.0.0 planned for Q1 2026); check Ivanti's advisory
- **CVEs:** CVE-2026-1281, CVE-2026-1340
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Identify every on-premises EPMM appliance and its version.
2. Apply the Ivanti security update RPM that matches your release line, using the latest revision Ivanti lists.
3. After any EPMM version upgrade, confirm the RPM fix is still in place or reapply it; watchTowr reports the RPM does not persist.
4. Run the vendor's log regex over Apache access logs to look for exploitation, and follow Ivanti's analysis guidance.
5. If exploitation is suspected, rebuild the appliance from a clean state and rotate credentials and integrations it stores (LDAP, certificates, API accounts).

### How to check if you are affected

- grep Apache/HTTPD access logs with the vendor regex ^.*\/mifs\/c\/\(aft\|app\)store.*theValue\?\?.* (Rapid7's copy).
- Look for GET requests to /mifs/c/appstore/fob/ or /mifs/c/aftstore/fob/ containing backticks, gPath[ or unusual st=theValue fields.
- Look for unexpected processes, web shells or outbound connections from the EPMM appliance since late January 2026.

## What happened

On January 29, 2026, Ivanti disclosed two code-injection vulnerabilities (CWE-94) in on-premises Endpoint Manager Mobile (EPMM), [CVE-2026-1281](https://nvd.nist.gov/vuln/detail/CVE-2026-1281) and [CVE-2026-1340](https://nvd.nist.gov/vuln/detail/CVE-2026-1340). Both allow unauthenticated remote code execution and are scored CVSS 3.1 9.8. According to [Rapid7](https://www.rapid7.com/blog/post/etr-critical-ivanti-endpoint-manager-mobile-epmm-zero-day-exploited-in-the-wild-eitw-cve-2026-1281-1340/), Ivanti said exploitation had occurred before disclosure. CISA added CVE-2026-1281 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281) the same day with a three-day deadline (February 1). It added [CVE-2026-1340](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1340) on April 8, 2026.

The bugs sit in the URL handling for two features, In-House Application Distribution (`/mifs/c/appstore/fob/`) and Android File Transfer Configuration (`/mifs/c/aftstore/fob/`). [watchTowr](https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/) showed that Apache `RewriteMap` entries passed request data to Bash scripts (`map-appstore-url`, `map-aft-store-url`). A crafted GET request could get shell commands executed through Bash arithmetic expansion. watchTowr published a working proof of concept on January 30.

## Who is affected

The affected product is on-premises Ivanti EPMM, formerly MobileIron Core. Rapid7, citing Ivanti, says versions 12.7.0.0, 12.6.0.0 and 12.5.0.0 and earlier take the 12.x.0.x RPM, and 12.6.1.0 and 12.5.1.0 and earlier take the 12.x.1.x RPM. EPMM servers usually face the internet so phones can enroll and fetch apps, which makes these endpoints reachable by design. A compromised MDM server can expose user names, email addresses, phone numbers, device location and identifiers, and it gives the attacker a privileged foothold for lateral movement.

## Do you really need to act?

Yes, if you run on-premises EPMM. The flaws were exploited as a zero-day, a public exploit appeared within a day, and no login is needed. EPMM has a track record here: Rapid7 notes earlier in-the-wild exploitation via CVE-2023-35078 and via the CVE-2025-4427/4428 chain.

The fix itself also needs checking. Ivanti shipped it as an RPM (`ivanti-security-update-1761642-1.0.0S-5` / `-1.0.0L-5`), not as a new release. watchTowr reported that the RPM has to be reapplied after later changes such as version upgrades, and that Ivanti planned a permanent fix in 12.8.0.0 for Q1 2026. CISA's April KEV entry points to revised packages (`-1.1.0S-5` / `-1.1.0L-5`). A server patched in January may not be patched now. Check which build and RPM revision Ivanti's [advisory](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340) currently recommends.

## What to do now

1. Inventory every EPMM appliance and record its version and installed security RPMs.
2. Install the latest security update RPM for your line (12.x.0.x or 12.x.1.x) as Ivanti lists it, or move to a release Ivanti says includes the permanent fix.
3. After any upgrade, verify the fix is still present. watchTowr notes the patch replaces the Bash RewriteMap scripts with Java classes (`AppStoreUrlMapper`, `AFTUrlMapper`) in the HTTPD config.
4. Hunt with the vendor regex below, and work through Ivanti's [analysis guidance](https://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US).
5. If you find signs of exploitation, rebuild rather than clean in place, and rotate the directory, certificate and API credentials the server held.

## How to tell if you were hit

Ivanti's regex for HTTPD access logs, as published by Rapid7 (updated March 19, 2026), is `^.*\/mifs\/c\/\(aft\|app\)store.*theValue\?\?.*`. Look for GET requests to `/mifs/c/appstore/fob/` or `/mifs/c/aftstore/fob/` containing `st=theValue`, `gPath[`, backticks or URL-encoded shell syntax. watchTowr's test payload used `sleep 5`. Logs on a compromised appliance can be tampered with, so also check for unexpected files and processes, and review network telemetry for outbound connections from the EPMM server since late January 2026.

## Timeline

- Jan 29, 2026 — Ivanti discloses both CVEs and says exploitation preceded disclosure. CISA adds CVE-2026-1281 to KEV (due Feb 1).
- Jan 30, 2026 — watchTowr publishes its root-cause analysis and PoC, and Rapid7 publishes its analysis.
- Mar 19, 2026 — Rapid7 updates the hunting regex based on new information from Ivanti.
- Apr 8, 2026 — CISA adds CVE-2026-1340 to KEV and references updated 1.1.0 RPMs.

## Sources

1. [Ivanti — Security Advisory: EPMM CVE-2026-1281 & CVE-2026-1340](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340)
2. [Ivanti — Analysis Guidance: EPMM CVE-2026-1281 & CVE-2026-1340](https://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US)
3. [NVD — CVE-2026-1281](https://nvd.nist.gov/vuln/detail/CVE-2026-1281)
4. [NVD — CVE-2026-1340](https://nvd.nist.gov/vuln/detail/CVE-2026-1340)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-1281](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-1340](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1340)
7. [Rapid7 — Critical Ivanti EPMM zero-day exploited in the wild (CVE-2026-1281 & CVE-2026-1340)](https://www.rapid7.com/blog/post/etr-critical-ivanti-endpoint-manager-mobile-epmm-zero-day-exploited-in-the-wild-eitw-cve-2026-1281-1340/)
8. [watchTowr Labs — Someone Knows Bash Far Too Well (Ivanti EPMM pre-auth RCEs)](https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/)

---
Source page: https://erroneo.us/security/briefs/ivanti-epmm-cve-2026-1281-1340-zero-day-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt