CVE-2026-1281criticalunder attackCWE-94

CVE-2026-1281: critical vulnerability in Ivanti Endpoint Manager Mobile

Published · Updated

Follow this CVE+ Monitor Endpoint Manager Mobile

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon21 days
Published on NVDJan 29
1st PoC+21d
metasploitJan 29
CISA KEVJan 29
Action required by CISAfederal deadline: 2026-02-01

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Ivanti Endpoint Manager Mobile has a flaw that lets attackers run malicious code on the system without needing to log in. This is critical because it allows complete control of affected devices.

Technical detail

A code injection vulnerability (CWE-94) in Ivanti Endpoint Manager Mobile permits unauthenticated remote code execution. The attack vector is network-based with no authentication requirement, resulting in full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Ivanti · Endpoint Manager Mobile
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ivanti Endpoint Manager Mobile

In the same product, most dangerous first.

CVE-2023-35078CRITICALCVE-2023-35078EPSS 100.0%KEVCVE-2025-4427MEDIUMAuthentication BypassEPSS 99.9%KEVCVE-2026-1340CRITICALCVE-2026-1340EPSS 98.6%KEVCVE-2025-4428HIGHRemote Code ExecutionEPSS 88.0%KEVCVE-2026-6973HIGHCVE-2026-6973EPSS 34.5%KEVCVE-2025-6771HIGHOS command injection in Ivanti Endpoint ManagerEPSS 23.0%