Loading story…
Attackers are exploiting critical unauthenticated remote code execution vulnerabilities CVE-2026-1281 and CVE-2026-1340 in Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core. Both flaws carry CVSS scores of 9.8 and stem from unsafe handling of attacker-controlled input in Bash scripts invoked through Apache RewriteMap. Telekom Security responders observed command-execution checks, JSP webshell deployment, reverse-shell attempts, secondary malware delivery, and database export attempts across multiple customer environments. CrowdSec reported exploitation-related activity increasing in early February and a small number of attackers targeting more than 500 distinct machines, without establishing how many were compromised; CVE-2026-1281 was also added to CISA’s Known Exploited Vulnerabilities catalog.
Public reporting indicates exploitation across multiple countries and sectors, while Germany’s BSI warned that attacks may have begun as early as summer 2025, before the flaws’ January 2026 disclosure. Patching alone does not remove previously established persistence. Organizations should apply current Ivanti patches, verify that RPM-based mitigations persist after reboots, restrict appliance access through a VPN, and assess systems using published detection guidance. Response teams should investigate webshells and other persistence, possible credential theft, data exfiltration, and lateral movement, and follow vendor guidance on upgrading to EPMM 12.8.0.0.
See which actors are running it and whether you're in range.
14 events from the most recent confirmed update back to the earliest known activity.
CrowdSec identified February 4 as the start of its observed active exploitation of CVE-2026-1281. Its telemetry showed a small number of attackers targeting more than 500 distinct machines, without establishing how many were successfully compromised.
CrowdSec telemetry indicated exploitation-related activity increasing around February 2, shortly after public disclosure of the EPMM vulnerabilities.
Ivanti disclosed CVE-2026-1281 and CVE-2026-1340 alongside emergency mitigation guidance. Both vulnerabilities carry CVSS scores of 9.8 and allow unauthenticated remote code execution on reachable vulnerable appliances.
Germany’s BSI warned that exploitation of the Ivanti EPMM vulnerabilities may have occurred since at least summer 2025. This was a possible earlier exploitation period, not a confirmed start date.
BSI confirmed targeting of German organizations and cited Shadowserver detection of more than 20 compromised organizations in Germany. It published compromise indicators and advised operators to assume possible compromise even if they patched on disclosure day, because patching does not remove existing persistence.
Defused separately described a /mifs/403.jsp backdoor that executes Base64-encoded Java bytecode in memory. The backdoor is triggered by requests containing the HTTP header k0f53cf964d387.
Unit 42 reported exploitation affecting organizations in the United States, Germany, Australia, and Canada across government, healthcare, manufacturing, services, and technology. It described predominantly automated activity involving webshells, malware downloads, and dormant backdoors intended to retain access after patching.
Attackers attempted to export EPMM database tables containing user, LDAP, device, configuration, and password-history information into a web-accessible directory. They also attempted to archive system files for possible exfiltration, but the reporting did not confirm data transfer.
Responders observed an attacker write a Base64-decoded ELF payload named sysd, make it executable, and launch it. Preliminary analysis identified file read/write activity, dropped files, and outbound contact to 217.148.142[.]48.
Incident responders investigated multiple customer environments and found successful command execution, JSP webshells including 401.jsp and 403.jsp, and reverse shell attempts. They withheld attribution because activity from multiple actors and botnets overlapped.
CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities catalog, recognizing exploitation in the wild.
WatchTowr demonstrated arbitrary command execution as the web server user through crafted URL parameters. Its technical reporting explained Bash arithmetic command substitution and the padding needed to bypass a string-length validation check.
Ivanti released RPM patches addressing the vulnerable URL mappings. The patches replace Bash-based Apache RewriteMap handlers with Java implementations.
WatchTowr Labs discovered an unauthenticated remote code execution vulnerability in Ivanti EPMM involving inadequately sanitized input processed by a Bash URL-mapping script.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Ivanti Endpoint Manager Mobile (EPMM)** is being actively exploited via two critical, unauthenticated remote code execution vulnerabilities, **CVE-2026-1281** and **CVE-2026-1340** (both reported as CVSS 9.8). Reporting describes attackers achieving full control of exposed EPMM/MDM infrastructure, including establishing reverse shells, deploying web shells, performing reconnaissance, and downloading additional malware; activity has been observed across multiple countries and sectors (including government, healthcare, manufacturing, and technology). **CISA added CVE-2026-1281 to the Known Exploited Vulnerabilities (KEV) Catalog**, and defenders are urged to apply Ivanti’s available fixes/updates per the vendor advisory. Telemetry and threat-intel observations indicate broad internet exposure and automation in exploitation. Unit 42 reported visibility into **4,400+** EPMM instances, and noted threat actors shifting from initial exploitation toward **dormant backdoors** intended to preserve access even after patching. GreyNoise data highlighted that a large share of observed exploitation traffic (reported as **83%**) originated from a single IP, `193.24.123.42`, associated with “bulletproof” hosting, with attackers rotating user-agent strings consistent with mass scanning/exploitation; the same infrastructure was also linked to attempts against other products (e.g., Oracle WebLogic, `telnetd`, and GLPI).
Jun 29, 2026
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, was found to contain multiple serious vulnerabilities that enabled unauthorized access, data exposure, and server compromise. The most prominent flaws, `CVE-2023-35078` and `CVE-2023-35081`, were patched by Ivanti in July 2023 after disclosure that attackers had exploited them against Norwegian organizations and a government agency. `CVE-2023-35078` is a critical authentication bypass affecting internet-facing API paths, while `CVE-2023-35081` is a directory traversal issue that can let an authenticated administrator write arbitrary files, including webshells; CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate patching and compromise assessment. Subsequent reporting and vendor disclosures showed the exposure was broader than initially understood. Rapid7 highlighted `CVE-2023-35078` as a critical API access flaw, while Ivanti later disclosed `CVE-2023-35082`, saying additional exploitation paths meant all supported EPMM 11.10, 11.9, and 11.8 versions, along with older MobileIron Core releases, were affected depending on configuration. A joint CISA and NCSC-NO advisory said APT actors used the bugs from at least April through July 2023, leveraging compromised SOHO routers as proxies, deleting Apache logs with a malicious `mi.war` Tomcat application, conducting LDAP reconnaissance, and likely pivoting through Ivanti Sentry toward internal Exchange systems. More recent dCERT advisories indicate Ivanti EPMM continues to face multiple vulnerabilities, including issues that may allow code execution.
Jun 29, 2026
Ivanti warned that its on-premises **Endpoint Manager Mobile (EPMM)** product contains two critical vulnerabilities, **`CVE-2026-1281`** and **`CVE-2026-1340`**, that can let an unauthenticated remote attacker execute arbitrary commands or code over the network. The flaws affect exposed EPMM servers and create a path to full server compromise and possible lateral movement into internal environments. Ivanti said its cloud offerings, including **Ivanti Neurons for MDM**, and the separate **Ivanti Endpoint Manager (EPM)** product are not affected, and it released patches, incident-response guidance, and a detection tool to help customers assess exposure and compromise. Follow-up advisories said the vulnerabilities are being **actively exploited**, prompting defenders to inspect EPMM systems for anomalous logs, unauthorized administrator-account changes, and suspicious device-configuration modifications. A later update citing Germany's **BSI** said exploitation may date back to **summer 2025**, expanding the scope of required forensic review beyond recent activity. Public reporting from security researchers, including Palo Alto Networks Unit 42 and vulnerability tracking sources, reinforced that the issue is an unauthenticated remote code execution risk requiring immediate patching and retrospective compromise hunting on affected on-premises deployments.
Aug 31, 2026