Ivanti EPMM Code Injection Remote Code Execution (CVE-2026-1281)

The CVE record says a code injection in Ivanti Endpoint Manager Mobile (EPMM) lets attackers achieve "unauthenticated remote code execution." Ivanti, the CVE numbering authority, scores it CVSS 3.1 9.8 Critical. The vector is AV:N/AC:L/PR:N/UI:N, so an attacker needs only network access to the server, with no login and no user action.

The record files the flaw under CWE-94, improper control of generation of code, and CAPEC-242 code injection. It gives no further technical detail. The remote code execution glossary entry explains why this class of bug gives an attacker control of the host.

What Public Write-Ups Claim

Two GitHub repositories mention CVE-2026-1281, and both also name its sibling CVE-2026-1340. The older one was created on 7 February 2026. Its README says the bug is reachable through the /mifs/c/appstore/fob/ path and works through Bash arithmetic expansion.

That README also lists exploit scripts, reverse shell and web shell payloads, and checks for defenders. The second repository, created on 19 February 2026, describes itself as a demo target that reproduces the bug for research. These are the authors' claims, and we have not run either project.

Exploitation Signals for CVE-2026-1281

CISA added the flaw to its Known Exploited Vulnerabilities catalog on 29 January 2026, the same day the CVE record went public. We checked these public signals on 4 November 2026.

CISA's required action is to apply mitigations per the vendor's instructions or stop using the product if none exist. Its KEV notes ask owners to check all internet-facing Ivanti products for signs of compromise. Our KEV glossary entry explains what the catalog listing means.

For another Ivanti product, see our page on the Ivanti Connect Secure bypass CVE-2026-104935. It is a separate flaw with its own CVE record and fix.

NVD, which analyzed the record, lists Ivanti EPMM as affected up to and including 12.5.0.0, plus the individual releases 12.5.1.0, 12.6.0.0, 12.6.1.0 and 12.7.0.0. NVD last modified the entry on 17 June 2026.

The CVE record marks two labels, "12.x.1.x RPM" and "12.x.0.x RPM", as unaffected. The record does not say which EPMM releases those labels cover, and it names no fixed release number. Ivanti's EPMM 12.8.0.0 release notes list CVE-2026-1281 and CVE-2026-1340 among the security vulnerabilities that release fixes.

CISA's KEV notes link two Ivanti security update RPM files for this CVE, named ivanti-security-update-1761642-1.0.0, one for the S and one for the L build. We recommend reading Ivanti's own advisory, which the CVE record links, before choosing a patch path. Our vulnerability management guide covers how to plan and verify a rollout.