Ivanti EPMM zero-days: CVE-2026-1281 and CVE-2026-1340 exploited in the wild

# What this is about

Ivanti Endpoint Manager Mobile (EPMM) is a central platform used to manage corporate phones and tablets (MDM/UEM). When zero-days (unknown or not-yet-patched vulnerabilities) are actively exploited, the risk is typically higher than with ordinary bugs: the service is often internet-facing, handles sensitive device identities, and runs with powerful privileges.

This post covers the reported active exploitation of Ivanti EPMM zero-days CVE-2026-1281 and CVE-2026-1340, and what you should do next.

# What “exploited in the wild” means for you

If a vulnerability is exploited “in the wild”, it means:

• Attacks are real, not just proof-of-concept demos.

• Attackers often automate scanning and exploitation quickly.

• Time is the critical factor: patching and containment come first.

# Why EPMM is an attractive target

EPMM sits where multiple high-value functions meet:

• Device enrollment and authentication

• Configuration profiles, certificates, tokens

• Access to corporate resources (for example VPN and email profiles)

In the worst case, a successful compromise can:

• Enable administrative access

• Allow configuration tampering

• Make lateral movement into the internal network easier

# Immediate actions (in a sensible order)

1) Confirm exposure: is your EPMM reachable?

• Check whether EPMM is reachable from the public internet (DNS, reverse proxy, load balancer).

• If possible, restrict access to known admin networks/VPN.

2) Confirm versions and patches

• Identify the exact EPMM version.

• Compare it to Ivanti security advisories and hotfixes.

• Patch as fast as possible, but with controlled change management (have a rollback plan).

3) Validate compromise indicators

Even after patching, you need validation. Goals:

• Was the vulnerability already exploited?

• Are there new admin accounts, API tokens, or suspicious configuration changes?

Practical checks (works even without a deep forensics team):

• Admin logins: unusual times, new source IPs, spikes in failed logins

• Configuration changes: new SSO settings, new certificates, new integrations

• Host indicators: new processes, unknown files, unplanned restarts

• Network: outbound connections from EPMM to unknown destinations

If you have a SIEM: alert on new admin roles, authentication changes, and suspicious web requests to EPMM.

4) Rotate credentials and secrets

If you see signs of exploitation (or you cannot reliably rule it out):

• Change admin passwords

• Re-issue API keys/tokens

• Review and, where feasible, replace certificates and SSO secrets

5) Containment and hardening

• Put EPMM behind a reverse proxy/WAF if it isn’t already.

• Enforce MFA for admin logins.

• Reduce admin access to a small set of named accounts.

• Enable detailed logging and ensure logs are centrally stored.

# Communication and decision logic (for non-technical owners)

If you’re accountable but not hands-on:

• Ask IT: “Is EPMM internet-facing, and what version are we on?”

• Ask security: “Did we perform compromise validation, and what did we find?”

• Ask management: “Which critical systems depend on EPMM (email, VPN, certificates), and what’s the business impact?”

Rule of thumb: if EPMM is exposed and unpatched, treat it like an incident—not a routine update.

# What to avoid

• Patching and moving on: with active exploitation, post-patch validation is critical.

• Turning on logging after the fact: you can’t recreate yesterday’s logs.

• Assuming “we’re too small”: automated scanning hits everyone.

# Short checklist

# Bottom line

With Ivanti EPMM, reported zero-days under active exploitation require fast, disciplined response: patching, compromise validation, rotation of critical secrets, and hardening. The sooner you shrink exposure, the higher the chance this stays a near-miss.