ZeroDay vulnerabilities fixed in Ivanti Endpoint Manager Mobile

🗓️ 20 Feb 2026 14:47:02Reported by NCSCType

Ivanti fixed two unauthenticated code flaws in Endpoint Manager Mobile; CVE-2026-1281 is exploited at a few customers; updates are available.

Reporter	Title	Published	Views	Family All 49
GithubExploit	Exploit for Code Injection in Ivanti Endpoint_Manager_Mobile	19 Feb 202621:29	–	githubexploit
GithubExploit	Exploit for Code Injection in Ivanti Endpoint_Manager_Mobile	7 Feb 202611:28	–	githubexploit
ATTACKERKB	CVE-2026-1731	6 Feb 202621:49	–	attackerkb
ATTACKERKB	CVE-2026-1281	29 Jan 202621:31	–	attackerkb
ATTACKERKB	CVE-2026-1340	29 Jan 202621:33	–	attackerkb
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager Mobile (EPMM) application for managing the lifecycle of mobile devices and applications lies in improper code generation. This allows an attacker to execute arbitrary code.	2 Feb 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager Mobile (EPMM) application for managing the lifecycle of mobile devices and applications lies in improper code generation. This allows an attacker to execute arbitrary code.	3 Feb 202600:00	–	bdu_fstec
Circl	CVE-2026-1281	29 Jan 202618:15	–	circl
Circl	CVE-2026-1340	29 Jan 202619:59	–	circl
CISA KEV Catalog	Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability	29 Jan 202600:00	–	cisa_kev

Source	Link
forums	www.forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340
ncsc	www.ncsc.nl/waarschuwing/ncsc-roept-organisaties-op-zich-te-melden-bij-gebruik-van-ivanti-endpoint-manager

20 Feb 2026 14:47Current

6.2Medium risk

Vulners AI Score6.2

CVSS 49.3

CVSS 3.19.8

EPSS0.8404

SSVC