CVE-2026-1340: Ivanti Endpoint Manager Mobile code injection

CVE-2026-1340 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-04-08

Ivanti Endpoint Manager Mobile (EPMM), a platform used by organizations to manage and secure mobile devices, contains a critical vulnerability. This flaw allows an unauthenticated attacker to remotely execute malicious code on the system over the network. Successful exploitation could lead to a complete takeover of the management server, potentially compromising all managed mobile devices and sensitive corporate data.

Technologies: Ivanti Endpoint Manager Mobile, Ivanti Endpoint Manager Mobile (EPMM), Ivanti MobileIron Core. Vendors: Ivanti.

Quick answers

Is CVE-2026-1340 exploited in the wild?
Yes. CVE-2026-1340 is known to be exploited in the wild, first recorded on 8 April 2026. Treat it as urgent.
How severe is CVE-2026-1340?
Critical severity, with a CVSS score of 9.8, published 8 April 2026.
Which products and versions are affected?
Ivanti Endpoint Manager Mobile Up to and including 12.7.0.0.
Is there a fix for CVE-2026-1340?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1340 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-1340?
Check whether you run Ivanti Endpoint Manager Mobile, Ivanti Endpoint Manager Mobile (EPMM) or Ivanti MobileIron Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in Ivanti Endpoint Manager Mobile (EPMM) versions up to and including 12.7.0.0. The flaw allows a remote, unauthenticated attacker to send specially crafted requests to the application to execute arbitrary code. This is a network-based attack that requires no user interaction or prior privileges. The vulnerability has been observed being exploited in the wild, and Ivanti has released security advisories and mitigations to address the issue.

Affected products

  • Ivanti Endpoint Manager Mobile (EPMM) Up to and including 12.7.0.0

Timeline

  • 2026-01-29: disclosed: Initial CVE publication and vendor advisory release
  • 2026-04-08: kev added: CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.