Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection

id: CVE-2026-1281

info:
  name: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection
  author: rxerium
  severity: critical
  description: |
    Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system.
  impact: |
    Unauthenticated remote attackers can execute arbitrary code on the EPMM appliance, leading to full system compromise. This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.
  remediation: |
    Apply the Ivanti security patch for EPMM or upgrade to a version above 12.7.0.0. Restrict network access to the EPMM management interface.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1281
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
    - https://www.helpnetsecurity.com/2026/01/30/ivanti-epmm-cve-2026-1281-cve-2026-1340/
    - https://www.cisa.gov/news-events/alerts/2026/01/29/cisa-adds-one-known-exploited-vulnerability-catalog
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-1281
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 1
    vendor: ivanti
    product: endpoint-manager-mobile
    shodan-query: product:"Ivanti Endpoint Manager Mobile (EPMM)"
  tags: cve,cve2026,ivanti,epmm,code-injection,rce,unauth,kev,vkev,passive

http:
  - raw:
      - |
        GET /mics/login.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<title>Ivanti System Manager: Sign In")'
          - 'contains(body, "Ivanti. All rights reserved.")'
        condition: and

      - type: dsl
        dsl:
          - '(compare_versions(version, ">= 12.5.0.0") && compare_versions(version, "< 12.6.0.0")) || (compare_versions(version, ">= 12.6.0.0") && compare_versions(version, "<= 12.7.0.0"))'

      - type: dsl
        dsl:
          - 'status_code == 200'

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - '<div[^>]*class="[^"]*product-version[^"]*"[^>]*>\s*([0-9.]+)\s*</div>'

      - type: regex
        name: detected_version
        part: body
        group: 1
        regex:
          - '<div[^>]*class="[^"]*product-version[^"]*"[^>]*>\s*([0-9.]+)\s*</div>'
# digest: 4a0a00473045022100a825227041cee635b0a78cc70e50604a36bfd6aeccf56f77dfe95add68d3da7f02200e54e51ccdfc53da50aa6e3952a4d70cc5a40ae0b89b5cb5e4e8959f26abad48:922c64590222798bb761d5b6d8e72950