Cyber Attack Hits European Commission Staff Mobile Systems

The European Commission detected an intrusion on 30 January 2026 into its central Mobile Device Management (MDM) infrastructure that coincided with two critical Ivanti EPMM code-injection vulnerabilities (CVE-2026-1281, CVE-2026-1340). CERT-EU contained and cleaned the affected systems within nine hours; the Commission reported potential exposure of staff names and phone numbers but no handset compromises. Similar exploitation impacted other government agencies, Ivanti released patches and an RPM detection tool, and a full review of the incident was promised.