PT-2026-5357 · Ivanti · Ivanti Endpoint Manager Mobile

Published

2026-01-29

·

Updated

2026-05-08

·

CVE-2026-1281

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile (affected versions not specified)
Description An unauthenticated remote code execution issue exists in Ivanti Endpoint Manager Mobile (EPMM) due to improper control of code generation. This occurs through a server-side template rendering pathway in the management interface, where improper input handling allows attacker-controlled expressions to be evaluated. A remote attacker can send crafted requests to the template rendering function to execute arbitrary OS-level commands in the context of the EPMM service. This could lead to full server compromise, takeover of the MDM infrastructure, exposure of stored credentials and secrets, and lateral movement into internal networks.
Recommendations Apply Ivanti security updates for EPMM as published in the official advisory channel. Restrict access to management ports, typically '443' and '8443', to VPN, jump hosts, and allowlisted IPs only. Disable non-essential template rendering features or endpoints as a temporary containment measure.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-01061
BDU:2026-01123
CVE-2026-1281

Affected Products

Ivanti Endpoint Manager Mobile