Log in Request a demo

Exploited vulnerability

Ivanti EPMM Second Code Injection Flaw (CVE-2026-1340)

A critical code injection flaw in Ivanti Endpoint Manager Mobile (EPMM) that lets an attacker run code on the server without logging in.

  • On CISA KEV
CVE ID
CVE-2026-1340
CVSS
9.8 Critical (CVSS v3.1, Ivanti as CNA; NVD shows the same score as a secondary source); no CVSS 4.0 score in the record or NVD
CISA KEV
Listed
Affected product
Ivanti Endpoint Manager Mobile (EPMM) 12.7.0.0 and earlier, per NVD
Exploited
Yes
Published
29 January 2026 (CVE record and NVD); CISA KEV 8 April 2026

In short

CVE-2026-1340 is a critical code injection flaw in Ivanti Endpoint Manager Mobile (EPMM) that lets an attacker run code on the server without logging in. Ivanti rates it CVSS 3.1 9.8, and CISA added it to the KEV catalog on 8 April 2026. It shares an advisory with CVE-2026-1281.

Profile MapVulnerability
  1. CVECVE-2026-1340
  2. ProductIvanti Ivanti Endpoint Manager Mobile (EPMM) 12.7.0.0 and earlier, per NVD
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps5actions listedCheck the Version Range · Install the Newer RPM Package

What it allows

CVE-2026-1340 is the second of two Ivanti Endpoint Manager Mobile (EPMM) flaws that share one advisory. The CVE record uses the same words as its sibling CVE-2026-1281: a code injection allowing attackers to achieve "unauthenticated remote code execution." Ivanti, the CNA, scores it CVSS 3.1 9.8 Critical, vector AV:N/AC:L/PR:N/UI:N.

The record files it under CWE-94 and CAPEC-242 code injection and gives no further technical detail. A network attacker therefore needs no login and no user action. The remote code execution glossary entry explains what that lets an attacker do.

What Separates It From CVE-2026-1281

The two records read alike, but the catalogues treat them differently. CVE-2026-1281 entered CISA KEV on the day it was published. CVE-2026-1340 followed on 8 April 2026, 69 days after its CVE record, with a due date of 11 April 2026.

NVD also lists a different version scope. CVE-2026-1340 has one range, every EPMM version up to and including 12.7.0.0, where CVE-2026-1281 has five separate entries.

What Public Write-Ups Claim

Two GitHub repositories cover both Ivanti CVEs, and the earlier one was created on 7 February 2026. Its README ties CVE-2026-1340 to the /mifs/c/aftstore/fob/ path and the sibling CVE to /mifs/c/appstore/fob/. The author says both work through Bash arithmetic expansion.

The second repository, created on 19 February 2026, describes itself as a demo target for research. These are the authors' claims, and we have not run either project.

Exploitation Signals for CVE-2026-1340

CISA lists the flaw in KEV, and the catalog is only one of several public signals. We checked these on 4 November 2026.

Exploit signals
  • CISA KEVYesAdded 8 April 2026 with a due date of 11 April 2026; ransomware campaign use is marked Unknown3 Nov
  • Exploitation in CISA SSVCYesExploitation active, automatable yes, technical impact total29 Jan
  • EPSSYesScore 0.98639, percentile 0.99924 on 3 November3 Nov
  • Public PoC code on GitHubYesTwo repositories that name both Ivanti CVEs, the earliest created 7 February 20264 Nov
Verdict In CISA KEV since 8 April 2026; CISA SSVC records active exploitation

CISA's KEV notes for this CVE link two Ivanti security update RPM files, named ivanti-security-update-1761642-1.1.0. The notes tell owners to check internet-facing Ivanti products for signs of compromise. Our KEV glossary entry explains the catalog.

For another Ivanti product, see our page on the Ivanti Connect Secure buffer overflow CVE-2025-22457. It is a separate flaw with its own CVE record and fix.

Who is affected

NVD, which analyzed the record, lists Ivanti EPMM as affected up to and including 12.7.0.0, as one version range. NVD last modified the entry on 17 June 2026.

The record marks the two RPM labels as unaffected but does not say which EPMM releases they cover. It names no fixed release number. Ivanti's advisory, which the record links, covers both CVEs, and Ivanti's EPMM 12.8.0.0 release notes list both under the security vulnerabilities that release fixes.

The KEV notes for CVE-2026-1340 link a newer RPM pair than those for CVE-2026-1281: 1.1.0 here against 1.0.0 there. We recommend applying whichever package Ivanti's advisory currently names. Our vulnerability management guide covers how to check a rollout.

Timeline

  1. 22 Jan 2026

    Ivanti reserves CVE-2026-1340.

  2. 29 Jan 2026

    The CVE record and NVD entry go public with the shared Ivanti advisory. CISA's SSVC entry records exploitation as active.

  3. 7 Feb 2026

    The earliest GitHub repository naming both Ivanti CVEs is created.

  4. 8 Apr 2026

    CISA adds CVE-2026-1340 to KEV with a due date of 11 April 2026.

  5. 17 Jun 2026

    NVD last modifies the analyzed entry.

  6. 3 Nov 2026

    EPSS scores the CVE at 0.98639.

What to do

  1. Treat Both Ivanti CVEs as One Job

    Ivanti covers CVE-2026-1340 and CVE-2026-1281 in a single advisory. Patch for both together, and track them as one ticket.

  2. Check the Version Range

    NVD lists every EPMM version up to and including 12.7.0.0 as affected. Any server on that range is exposed until the vendor patch is in place.

  3. Install the Newer RPM Package

    CISA's KEV notes for this CVE link ivanti-security-update-1761642-1.1.0 files. Confirm in Ivanti's advisory which package is current before you install.

  4. Look Back to January

    The sibling flaw was in KEV from 29 January 2026, and this one from 8 April 2026. We recommend reviewing logs on internet-facing EPMM servers from late January onward.

  5. Follow CISA's Required Action

    CISA says to apply mitigations per the vendor's instructions, or stop using the product if none are available. Record who owns that decision for each EPMM server.

Questions

Is CVE-2026-1340 exploited?

CISA lists it in the KEV catalog, added on 8 April 2026, and its SSVC entry records exploitation as active. EPSS gave it 0.98639 on 3 November 2026.

What version range does NVD list for CVE-2026-1340?

NVD lists one range: every Ivanti EPMM version up to and including 12.7.0.0. The CVE record names no fixed release number.

Why did CISA add CVE-2026-1340 later than its sibling?

The records show the dates but not CISA's reasons. CVE-2026-1281 entered KEV on 29 January 2026, and CVE-2026-1340 on 8 April 2026, 69 days after its CVE record.

Is a CVE-2026-1340 patch different from the CVE-2026-1281 patch?

CISA's KEV notes link a 1.1.0 RPM pair for this CVE and a 1.0.0 pair for the sibling. Ivanti's advisory covers both CVEs, so check it for the current package.

Sources

  1. CVE-2026-1340 Record CVE Program / Ivanti CNA
  2. CVE-2026-1340 NVD
  3. Ivanti EPMM Resolved Issues, 12.8.0.0 Ivanti
  4. Known Exploited Vulnerabilities Catalog, CVE-2026-1340 CISA
  5. Exploit Prediction Scoring System (EPSS) FIRST

Last updated 4 November 2026

Browse the threat library

Keep exploring

Knowledge Hub