Ivanti Endpoint Manager Mobile Code Injection (CVE-2026-1340)

Historical catalog analysis: CISA added this entry on April 08, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-1340 is a code injection vulnerability (CWE-94) affecting Ivanti Endpoint Manager Mobile (EPMM). The flaw could allow an unauthenticated attacker to achieve remote code execution on the affected system. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on April 8, 2026.

Exposure and applicability

This vulnerability applies to organizations deploying Ivanti EPMM. Systems that are internet-accessible are at higher risk of exploitation due to the unauthenticated nature of the flaw. Infrastructure owners should prioritize identifying all instances of EPMM within their environment to determine the scope of exposure.

Remediation priorities

Based on available data, our analysis suggests the following prioritization for vulnerability management teams:

1. Immediate Mitigation Application: Apply vendor-supplied mitigations according to Ivanti’s specific instructions. For those utilizing cloud services, follow BOD 22-01 guidance.
2. Compromise Assessment: Conduct a security review of all internet-accessible Ivanti EPMM instances to identify signs of potential compromise, as the vulnerability allows for unauthenticated access.
3. Decommissioning: If vendor mitigations are unavailable or cannot be applied to a specific deployment, discontinue use of the product to eliminate the attack surface.

How to validate remediation

Verification must go beyond confirming a version number or the presence of a patch. To ensure exposure is reduced, defenders should:

• Verify Mitigation State: Confirm that the specific vendor-recommended configuration changes or patches are active and functioning as intended per Ivanti’s guidelines.
• Audit Access Logs: Review logs for unauthorized attempts to execute code or unusual administrative activity on EPMM servers.
• Validate Connectivity: Ensure that internet-facing instances are restricted to only necessary traffic, reducing the likelihood of unauthenticated remote access.

Limits and open questions

It remains unknown whether this vulnerability has been utilized by ransomware campaigns. Furthermore, while mitigations reduce risk, residual risk persists if compromise assessment is not performed on previously exposed systems; a patch prevents future exploitation but does not remove an attacker who may have already gained access. The effectiveness of the mitigation depends entirely on adherence to the vendor’s specific implementation guidelines.

Source and editorial note

CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability · Source date: April 08, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 11, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 15, 2026 at 00:28 UTC.

Request a Vulnerability Assessment