CVE-2026-1340criticalunder attackCWE-94

CVE-2026-1340: critical vulnerability in Ivanti Endpoint Manager Mobile

Published · Updated

Follow this CVE+ Monitor Endpoint Manager Mobile

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon9 days
Published on NVDJan 29
1st PoC+9d
metasploitJan 29
CISA KEV+69d
Action required by CISAfederal deadline: 2026-04-11

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Attackers can run malicious code on Ivanti Endpoint Manager Mobile without needing to log in. This is a serious flaw that puts devices and data at immediate risk.

Technical detail

Unauthenticated code injection vulnerability in Ivanti Endpoint Manager Mobile (CWE-94) allows remote attackers to execute arbitrary code without authentication. The attack vector is network-based with no special preconditions required, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Ivanti · Endpoint Manager Mobile
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ivanti Endpoint Manager Mobile

In the same product, most dangerous first.

CVE-2023-35078CRITICALCVE-2023-35078EPSS 100.0%KEVCVE-2025-4427MEDIUMAuthentication BypassEPSS 99.9%KEVCVE-2026-1281CRITICALCVE-2026-1281EPSS 98.7%KEVCVE-2025-4428HIGHRemote Code ExecutionEPSS 88.0%KEVCVE-2026-6973HIGHCVE-2026-6973EPSS 34.5%KEVCVE-2025-6771HIGHOS command injection in Ivanti Endpoint ManagerEPSS 23.0%