Ivanti Zero-Day Vulnerabilities (CVE-2026-1281, CVE-2026-1340) Disclosed

THE THREAT

On January 29th, 2026, Ivanti disclosed two critical zero-day vulnerabilities impacting the Ivanti Endpoint Manager Mobile (EPMM) product. The vulnerabilities are tracked as CVE-2026-1281 (CVSS: 9.8) and CVE-2026-1340 (CVSS: 9.8), with successful exploitation leading to unauthenticated Remote Code Execution (RCE), enabling device compromise and payload deployment. Ivanti has confirmed that they are "aware of a very limited number of customers whose solution has been exploited at the time of disclosure" and have released patches to address the vulnerabilities. Ivanti also published an Analysis Guide, with the aim of providing customers with a query that can be used to search Apache Access Logs for exploitation attempts. As exploitation is ongoing, organizations are urged to apply the relevant security patches immediately.

What we're doing about it

• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• The eSentire Tactical Threat Response (TTR) team has developed MDR for Network detections to identify exploitation attempts
• eSentire's Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches released by Ivanti
• Review the Apache Access Logs using the query provided by Ivanti to check for exploitation attempts

Additional information

CVE-2026-1281 and CVE-2026-1340 impact the In-House Application Distribution and Android File Transfer Configuration features within EPMM. Ivanti highlights that the vulnerabilities only impact EPMM products, and does not impact any other Ivanti products, including cloud products. Ivanti has provided relevant patches to address the vulnerabilities, and states that a permanent fix will be included in version 12.8.0.0, which will be released in Q1 2026. The patches do not survive version upgrades, so if an EPMM instance is upgraded to a newer version after the relevant patch is applied, it will need to be reinstalled.

Within their Analysis Guide for the vulnerabilities, Ivanti indicates that they do "not have enough information about the threat actor tactics" to provide a list of reliable Indicators of Compromise (IoCs), but do provide a query that can be used to "quickly triage httpd log files" to hunt for evidence of exploitation. Ivanti recommends reviewing relevant logs within a SIEM or other log collector, also known as off-box logging, as exploitation of the vulnerabilities could allow threat actors to clear or tamper with logs to remove relevant entries. While no additional details are provided on the attacks that Ivanti mentions, they indicate that previous attacks targeting older EPMM vulnerabilities have often involved the deployment of webshells and reverse shells for persistent access following exploitation, underscoring that Ivanti EPMM vulnerabilities have a history of being targeted.

On January 29th, 2026, CISA added only one of the vulnerabilities, CVE-2026-1281, to its Known Exploited Vulnerabilities (KEV) catalog, providing federal agencies with a deadline of February 1st, 2026, to apply relevant patches. As CISA typically gives federal agencies a three-week timeframe to apply mitigations, the deadline of a few days underscores its criticality. While CISA also does not provide any context behind the observed exploitation, or why only one of the two zero-day vulnerabilities was added to the KEV, its addition indicates that CISA has reliable evidence to support ongoing exploitation. On January 30th, watchTowr Labs published a technical report on the vulnerabilities, which includes Proof-of-Concept (PoC) exploit code. Given the severity of the vulnerabilities and the availability of PoC exploit code, organizations are urged to prioritize patching immediately.

References:
[1] https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-1281
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-1340
[4] https://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US
[5] https://www.cisa.gov/news-events/alerts/2026/01/29/cisa-adds-one-known-exploited-vulnerability-catalog
[6] https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/