Ivanti Endpoint Manager Mobile (EPMM) Unauthenticated Remote Code Execution Vulnerability Advisory (CVE-2026-1340)

1. Apply Official Security Patches

Immediately download and apply the latest security updates from the Ivanti Customer Portal.

2. Temporary Mitigations (Prior to Patching)

If immediate patching is not feasible, implement the following network-level mitigations:

• Access Control Lists (ACLs):

Restrict access to the EPMM administration and API interfaces, ensuring they are not exposed to the public internet. Limit access to trusted internal IP ranges or VPN gateways.

• Web Application Firewall (WAF) Rules:

Deploy WAF signatures designed to detect and block common command injection and code injection payloads.

  # Example: Restricting access to sensitive API paths via Nginx reverse proxy
  location /mifs/services/ {
      allow 10.0.0.0/8; # Trusted internal network
      deny all;
  }

Vulnerability Overview

A critical Code Injection vulnerability (CWE-94) has been identified in Ivanti Endpoint Manager Mobile (EPMM). This vulnerability allows remote, unauthenticated attackers to execute arbitrary code on the underlying operating system by sending specially crafted network requests.

Attack Mechanics & Impact

• Attack Vector (AV:N): The vulnerability is exploitable remotely over the network.
• Low Complexity & No Privileges Required (AC:L / PR:N): Attackers do not need valid credentials or user interaction (UI:N) to trigger the exploit, making it highly dangerous.
• Active Exploitation (CISA KEV): This vulnerability is actively being exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
• High EPSS Score: With an EPSS score of 0.94, there is an extremely high probability of widespread automated exploitation attempts.