CISA Urges Urgent Patching of Critical Ivanti EPMM Vulnerability CVE-2026-1340

CISA has issued an urgent advisory for a critical Ivanti Endpoint Manager Mobile vulnerability (CVE-2026-1340) — an unauthenticated code injection/RCE with a CVSS of 9.8 — confirming active exploitation and adding it to the Known Exploited Vulnerabilities catalog; federal agencies are mandated to patch by April 11, 2026 under BOD 22-01, and roughly 950 exposed Ivanti EPMM endpoints remain reachable online.