Ivanti Patches Two Zero-Days in Mobile Manager After Attackers Exploit Vulnerable Systems

Ivanti disclosed two critical code-injection zero-day vulnerabilities in on-premises Endpoint Manager Mobile (CVE-2026-1281 and CVE-2026-1340) that allow unauthenticated remote code execution; limited exploitation has been observed and CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities catalog. Ivanti released RPM-based mitigations and recommends restoring from known-good backups or rebuilding compromised appliances, rotating credentials and certificates, and reviewing Sentry integrations for potential lateral movement; organizations are strongly urged to apply mitigations and patch immediately.