Ivanti’s EPMM is under active attack, thanks to two critical zero-days

Ivanti disclosed two critical EPMM zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340, CVSS 9.8) that permit unauthenticated remote code execution and have been actively exploited in the wild; some customers were attacked prior to public disclosure. CISA added one of the flaws to its Known Exploited Vulnerabilities catalog, Shadowserver observed spikes in exploitation attempts, and many Ivanti EPMM instances remain internet-exposed; Ivanti issued temporary mitigations and plans a permanent fix.