PT-2026-5358 · Ivanti · Ivanti Endpoint Manager Mobile

Published 2026-01-29 · Updated 2026-05-08 · CVE-2026-1340

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile versions prior to v12.1.0.2 or v11.12.0.1.

Description Ivanti Endpoint Manager Mobile (EPMM) contains a code injection flaw that allows attackers to achieve unauthenticated remote code execution (RCE). This vulnerability allows an attacker to bypass login and execute arbitrary code on the system. The vulnerability is actively exploited in the wild, with automated scanners targeting vulnerable systems. Approximately 950 systems are currently exposed. The vulnerability exists in a legacy API endpoint (/mifs/services/) where improper input sanitization allows attackers to inject commands using backticks (```) or semicolons (;) within a POST request. The EPMM service runs with high privileges, enabling attackers to gain control of the server. This represents a supply-chain compromise of the mobile perimeter, potentially allowing attackers to push malicious updates to managed devices and exfiltrate sensitive data.

Recommendations Update to version v12.1.0.2 or v11.12.0.1 or later. If unable to patch immediately, shut down the management interface (ports 443/8443). Audit web logs for suspicious POST requests to /mifs/services/ containing shell metacharacters. Scan for newly created .jsp or .php files in the /mifs/ web directories. Inspect the Admin Portal for unauthorized administrators or modified security policies.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-01123

CVE-2026-1340

Affected Products

Ivanti Endpoint Manager Mobile

References · 200

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01123 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1340 · Security Note
• https://twitter.com/cybertzar/status/2017610921284161640 · Twitter Post
• https://twitter.com/ThreatSynop/status/2021155952376889735 · Twitter Post
• https://twitter.com/DarkWebInformer/status/2017315679213408321 · Twitter Post
• https://reddit.com/r/KibernetinisSaugumas/comments/1qr2yij/ivanti_endpoint_manager_0day · Reddit Post
• https://twitter.com/vuldb/status/2017136341176504363 · Twitter Post
• https://twitter.com/ThreatSynop/status/2017163694765916257 · Twitter Post
• https://i.redd.it/am1eg98xj3jg1.png · Reddit Post
• https://twitter.com/DarkWebInformer/status/2018070295572107601 · Twitter Post
• https://twitter.com/threatintel/status/2024186387772428537 · Twitter Post
• https://twitter.com/ThreatSynop/status/2020907793469800799 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1qrb6uc/critical_ivanti_endpoint_manager_mobile_epmm · Reddit Post