Hackers Exploiting Ivanti EPMM Devices to Deploy Dormant Backdoors

Ivanti EPMM appliances are being actively exploited in the wild to install a dormant, in-memory Java class loader at /mifs/403.jsp (class base.Info) via unauthenticated flaws (CVE-2026-1281 and CVE-2026-1340); the loader awaits a second-stage Base64-encoded class delivered via the HTTP parameter k0f53cf964d387, avoids disk writes, and returns responses wrapped in delimiters (3cd3d / e60537). The report includes detection and mitigation guidance (patch and restart application servers), a SHA-256 for the implant, request/response patterns to hunt for, and a list of observed source IPs.