Unauthenticated RCE in Ivanti Endpoint Manager Mobile In-House App Distribution
CVE-2026-1281 is a critical code injection vulnerability in on-premises Ivanti Endpoint Manager Mobile (EPMM) affecting the In-House App Distribution component. The flaw resides in legacy bash-based Apache RewriteMap handling, specifically the /mi/bin/map-appstore-url script used to process requests for the /mifs/c/appstore/fob/ endpoint. According to the provided content, attacker-controlled URL parameters are passed into the bash script in an unsafe manner, enabling exploitation via bash arithmetic expansion and variable indirection. A remote attacker can send a crafted HTTP GET request to the vulnerable endpoint and achieve code execution on the EPMM appliance without authentication. Ivanti disclosed the issue on 2026-01-29, and the content states it was actively exploited in the wild prior to public disclosure.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository purpose: a Dockerized dummy target that reproduces the Ivanti EPMM pre-auth RCE class (CVE-2026-1281 / CVE-2026-1340) in a simplified, educational setup. How the exploit works (core bug): - `scripts/map-appstore-url` is a Bash CGI script that URL-decodes `REQUEST_URI`, extracts the `sha256:<params>` segment, and splits it into comma-separated key=value pairs. - During parsing, it sets `gStartTime` from the `st=` parameter and later sets `theValue` from the last processed parameter (notably `h=`). The loop variable `theValue` persists after the loop. - If the attacker sets `st=theValue␠␠` (literal string plus padding to reach length 10) and sets `h=gPath[`<cmd>`]`, then later the script evaluates `[[ ${currentTime} -gt ${gStartTime} ]]`. - In Bash, the `-gt` comparison triggers arithmetic evaluation; the string `theValue` is treated as a variable reference, expanding to the attacker-controlled `theValue` content (`gPath[`cmd`]`). The array index contains backticks, causing command substitution and thus remote command execution. Exploit capabilities demonstrated: - Arbitrary command execution as the CGI process user (in the container, examples show root-like output in artifacts). - File write/creation under `/mi` (mounted to `./artifacts`) to prove execution. - Time-based execution (`sleep N`) to confirm RCE without relying on output. Repository structure: - `Dockerfile`: builds a Debian-based container with nginx + fcgiwrap, installs the vulnerable CGI script, and prints example vulnerable URLs on startup. - `nginx.conf`: exposes `/health` and routes `/mifs/c/appstore/fob/3/<int>/sha256:<...>/<name>.ipa` to the CGI script via fcgiwrap. - `scripts/map-appstore-url`: the vulnerable Bash CGI implementation and logging. - `docker-compose.yml`: runs the container on host port 8180 and mounts `./artifacts` to `/mi` for observing exploit artifacts. - `test-exploit.sh`: automated local test suite that hits `/health` and sends exploit requests to create/write files and perform a time-based check. - `README.md`: explains the vulnerability chain and provides example curl payloads. Notable observables/fingerprintable targets: - HTTP endpoints: `/health` and the regex-matched `/mifs/c/appstore/fob/3/.../.ipa` path. - Local artifact paths: `/mi/*` in-container and `./artifacts/*` on host. - Potential documentation inconsistency: README includes an example using `localhost:81080` while compose maps `8180:80`.
Repository purpose: an operational PoC toolkit for unauthenticated RCE against Ivanti EPMM via CVE-2026-1281 and CVE-2026-1340. The exploit abuses a crafted URL path under /mifs/c/(appstore|aftstore)/fob/ where parameters include st=theValue␠␠ and h=gPath[`<command>`], leveraging Bash arithmetic/command substitution behavior (as described) to execute arbitrary commands pre-auth. Structure and key files: - exploit.py (Python): primary exploit client. Implements (1) endpoint reachability checks for /mifs/c/appstore/fob/ and /mifs/c/aftstore/fob/ (treating 400/403/404 as indicative of presence), (2) payload construction embedding gPath[`cmd`] into the h parameter with a fixed kid=1 and et=1337133713, and (3) exploitation via GET requests to /mifs/c/*store*/fob/3/5/sha256:<params>/<fake_guid>. CLI supports: --check, --test-rce (sleep-based), -x/--execute arbitrary command, --webshell (JSP dropper), and --reverse-shell IP:PORT. - validate.py (Python): automated validation framework that repeatedly builds exploit URLs and runs multiple tests (endpoint accessibility, time-based sleep injection, file-write marker, etc.), logging results and exporting a JSON report. - PAYLOADS.md / REDTEAM_GUIDE.md (Markdown): extensive operator playbook and payload catalog (reverse shells, webshells, persistence, exfiltration, recon/pivoting). These documents include many example commands and internal/external endpoints used for callbacks and testing. - detect_compromise.sh (Bash): blue-team/IR IOC scanner for EPMM hosts. Scans /var/log/httpd/https-access_log for exploit markers (gPath[, theValue, vulnerable paths, and common command tokens), searches /mi and /mi/tomcat for recently modified JSPs and webshell patterns, checks for patch indicators (RPM ivanti-security-update-1761642 and presence of specific .class files), and packages evidence into a tar.gz. Exploit capabilities (as implemented/documented): - Pre-auth network RCE via crafted HTTP GET request path. - RCE confirmation via time delay (sleep). - Arbitrary command execution; optional webshell deployment and reverse-shell callback (operator-supplied LHOST:LPORT). - Post-exploitation guidance includes persistence (SSH keys, cron, systemd), credential harvesting, and data exfiltration (DNS/HTTP), though many of these are documented payloads rather than hardcoded in the exploit core. Notable observables for defenders: - Requests to /mifs/c/(aft|app)store/fob/ with parameters containing st=theValue␠␠ and h=gPath[`...`], often resulting in 404 responses. - Potential dropped artifacts under /mi/tomcat/webapps/ROOT/*.jsp, modified error JSPs (401.jsp/403.jsp/404.jsp/500.jsp), and marker files under /tmp. - Outbound callbacks to operator-controlled IP:PORT (examples use 10.10.14.5:4444) and possible DNS queries to attacker.com for exfiltration.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
357 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pre-auth code injection / RCE vulnerability in Ivanti EPMM In-House App Distribution caused by bash arithmetic expansion in RewriteMap-linked bash scripts.
A zero-day authentication bypass vulnerability affecting Ivanti EPMM, with active exploitation confirmed in Proofpoint telemetry but not yet listed in CISA KEV at the time referenced.
A code-injection vulnerability in Ivanti EPMM that was exploited as a zero-day against a limited number of customers.
An earlier critical Ivanti EPMM vulnerability that could enable unauthenticated remote code execution and was added to CISA's KEV catalog.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.