3 posts
CISA has added CVE-2026-1340, a code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM), to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. All organizations, especially federal agencies under BOD 22-01, are strongly urged to prioritize timely remediation to protect their networks against active threats.
Threat actors are exploiting critical RCE vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti EPMM to deploy AntSword-based webshells. The automated attacks achieve root privilege escalation and rapidly exfiltrate sensitive databases and configuration files containing credentials.
Ivanti has released a security advisory addressing two critical code injection vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Endpoint Manager Mobile (EPMM) that allow unauthenticated remote code execution. At least one of these flaws is currently being exploited in the wild, prompting urgent recommendations to secure forensic evidence and apply available hotfixes.
