CISA Warns of Critical Ivanti EPMM Code Injection Vulnerability Exploited in Attacks

CISA issued an urgent warning for CVE-2026-1340 in Ivanti Endpoint Manager Mobile (EPMM): an unauthenticated RCE vulnerability actively exploited in the wild that can grant attackers administrative control over servers and enable mass compromise or malicious configuration of managed mobile devices. CISA added the flaw to the Known Exploited Vulnerabilities list, mandated rapid remediation for federal agencies (remediate by April 11, 2026), and advises all organizations to apply vendor patches or disconnect affected systems immediately.