Back to overview

CVE-2026-1281

CRITICAL KEV CISA Exploitation: ACTIVE
9.8
CVSS 3.1
Description
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Metadata

CVE ID
CVE-2026-1281
State
PUBLISHED
Assigner
ivanti
Reserved
2026-01-21 03:38 UTC
Published
2026-01-29 21:31 UTC
Last updated
2026-02-26 15:04 UTC
Primary CWE
CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product
Ivanti / Endpoint Manager Mobile
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
yes
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Vendor
Ivanti
Product
Endpoint Manager Mobile (EPMM)
Added to KEV
2026-01-29
Due date
2026-02-01
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA description
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
Affected products (1)
VendorProductPlatformVersions
Ivanti Endpoint Manager Mobile — 12.x.1.x RPM, 12.x.0.x RPM
Weakness (CWE)
CWESourceDescription
CWE-94 cna CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (1)
Back to overview