Ivanti warns of two EPMM flaws exploited in zero-day attacks

Ivanti disclosed two critical code-injection zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Endpoint Manager Mobile (both CVSS 9.8) that have been exploited in the wild, enabling unauthenticated remote code execution and exposure of administrator/user data and managed-device information. Ivanti published RPM hotfixes with no downtime required, detection guidance (including an Apache access-log regex to find exploitation attempts), and recommends restoring from known-good backups or rebuilding compromised appliances; CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities catalog.