Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 / CVE-2026-1340)
Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 / (TL-2026-0002), also tracked as Ivanti EPMM RCE, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-01-29. It carries a reported China nexus and is not formally attributed, affects Ivanti Endpoint Manager Mobile (EPMM), references 2 CVEs (CVE-2026-1281, CVE-2026-1340), maps to 26 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 15 detection rules and 55 indicators of compromise.
Key facts for TL-2026-0002
- Threat ID
- TL-2026-0002
- Also known as
- Ivanti EPMM RCE, Ivanti EPMM Pre-Auth RCE
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-01-29
- Last reviewed
- 2026-01-29
- Attribution confidence
- NONE
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- Government, Defense, Healthcare, Financial Services, Technology
- Target regions
- Europe, North America, Asia-Pacific
- Detection rules
- 15
- Indicators of compromise
- 55
CVE-2026-1281 is a critical pre-authentication Remote Code Execution (RCE) vulnerability in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core), affecting versions prior to 12.3.0.1. The vulnerability allows an unauthenticated attacker to achieve full remote code execution on the EPMM server via crafted API requests to the device management interface. CVSS 9.8 (Critical). Ivanti EPMM is a Mobile Device Management (MDM) platform used by enterprises, government agencies, and military organizations worldwide to manage and secure mobile device fleets — making it a HIGH-VALUE TARGET because compromising the MDM server grants control over all managed mobile devices. The vulnerability was discovered being actively exploited in the wild by suspected state-sponsored actors targeting government and defense organizations. Exploitation grants root-level access to the EPMM server, enabling: enumeration and control of all managed mobile devices, access to device configuration profiles including WiFi credentials and VPN configurations, email account access through managed profiles, location tracking of all enrolled devices, remote wipe capability, and lateral movement into the enterprise network. Ivanti products have been repeatedly targeted by sophisticated adversaries: CVE-2023-35078 and CVE-2023-35081 (MobileIron/EPMM), CVE-2024-21887 and CVE-2023-46805 (Connect Secure VPN), and CVE-2024-8963 (CSA). The pattern demonstrates that Ivanti edge devices are a STRATEGIC ATTACK SURFACE for nation-state actors seeking access to enterprise and government networks.
How Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 / works
CVE-2026-1281 represents the continuation of a persistent pattern: Ivanti enterprise security products being compromised to gain access to the organizations they are supposed to protect.
**The Product — Ivanti EPMM:**
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, is an enterprise Mobile Device Management (MDM) platform that: - Manages and secures mobile device fleets (iOS, Android, Windows) across enterprises - Controls device enrollment, configuration profiles, app deployment, and security policies - Stores device credentials (WiFi, VPN, email configurations) - Provides remote lock, wipe, and location tracking capabilities - Used by Fortune 500 companies, government agencies, defense organizations, and military - Deployed as an on-premises appliance or cloud-hosted service - Manages thousands to hundreds of thousands of devices per deployment
Compromising the EPMM server is equivalent to compromising EVERY mobile device it manages.
**The Vulnerability — CVE-2026-1281:**
- **Type**: Pre-authentication Remote Code Execution - **CVSS**: 9.8 (Critical) - **Vector**: Network-accessible API endpoint, no credentials required - **Root Cause**: Improper input validation in the device enrollment API leading to deserialization of untrusted data - **Exploitation**: Crafted HTTP request to the enrollment endpoint triggers code execution as root/SYSTEM on the EPMM appliance - **Complexity**: Low — reliable exploitation achievable with single HTTP request - **Affected Versions**: Ivanti EPMM prior to 12.3.0.1 - **Patch Available**: Yes — Ivanti EPMM 12.3.0.1 and later
**Exploitation in the Wild:**
Active exploitation was detected targeting: - Government agencies in Europe and North America - Defense contractors managing classified device fleets - Healthcare organizations managing clinical devices - Financial institutions managing corporate mobile fleets
The exploitation pattern matches sophisticated, targeted operations: - Scanning for exposed EPMM instances on internet-facing management interfaces - Single-request exploitation achieving root access - Post-exploitation: enumeration of managed device fleet, extraction of configuration profiles, deployment of persistent backdoors - Evidence of follow-on activity against managed mobile devices (configuration profile manipulation, credential extraction)
**Post-Exploitation Impact — MDM as Pivot:**
1. **Device Fleet Control**: Attacker gains administrative control over ALL managed mobile devices — can push malicious profiles, extract credentials, deploy surveillance 2. **Credential Harvest**: MDM stores WiFi credentials, VPN configurations, email account settings, certificate private keys — all extractable from compromised server 3. **Location Surveillance**: MDM can track real-time location of all enrolled devices — intelligence goldmine for state-sponsored actors targeting government officials 4. **Communication Access**: Managed email profiles grant access to organizational email through device management APIs 5. **Lateral Movement**: MDM server sits at the intersection of mobile and enterprise networks — compromised server enables network pivoting 6. **Remote Wipe Weapon**: Attacker can remotely wipe ALL managed devices simultaneously — destructive capability affecting thousands of devices 7. **Persistent Access**: Backdoors on MDM server persist through mobile device policy updates, affecting all future device enrollments
**Ivanti Product Exploitation History:**
Ivanti products represent a PATTERN of strategic compromise: - **CVE-2023-35078 + CVE-2023-35081** (Jul 2023): EPMM/MobileIron pre-auth access + RCE. Exploited against Norwegian government ministries. - **CVE-2024-21887 + CVE-2023-46805** (Jan 2024): Connect Secure VPN auth bypass + RCE chain. Mass exploitation by multiple threat actors including suspected Chinese state-sponsored groups. - **CVE-2024-8963** (Sep 2024): Cloud Services Appliance (CSA) admin bypass. Chained with other vulns for full compromise. - **CVE-2026-1281** (Current): EPMM pre-auth RCE. Continues the pattern of critical pre-auth vulnerabilities in enterprise edge devices.
The consistent targeting of Ivanti products reflects adversary STRATEGIC PRIORITIZATION: these devices sit at network boundaries, are internet-facing by design, and provide access to the most sensitive enterprise assets (mobile devices, VPN connections, cloud services).
MITRE ATT&CK techniques used in TL-2026-0002
collection
T1005 Data from Local System; T1213 Data from Information Repositories
defense-evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1203 Exploitation for Client Execution
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy
discovery
T1082 System Information Discovery; T1087 Account Discovery
persistence
T1098 Account Manipulation; T1133 External Remote Services; T1136 Create Account; T1505 Server Software Component; T1505.003 Web Shell
initial-access
T1190 Exploit Public-Facing Application
lateral-movement
T1210 Exploitation of Remote Services
impact
credential-access
T1552 Unsecured Credentials; T1552.001 Credentials In Files
resource-development
reconnaissance
T1595 Active Scanning; T1596 Search Open Technical Databases
defense-impairment
Affected products and versions in Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 /
- Ivanti — Endpoint Manager Mobile (EPMM)
Vulnerable versions: 12.7.0.0 and prior; 12.6.0.0 and prior; 12.5.0.0 and prior; 12.6.1.0 and prior; 12.5.1.0 and prior
Fixed in: RPM 12.x.0.x hotfix (temporary); RPM 12.x.1.x hotfix (temporary); 12.8.0.0 (permanent fix, Q1 2026)
Remediation for Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 /
Patches
- [object Object]
- [object Object]
Immediate actions
- Apply Ivanti RPM hotfix immediately (RPM 12.x.0.x for 12.5-12.7.0.x; RPM 12.x.1.x for 12.5.1.0-12.6.1.0)
- If compromise suspected: restore from known-good backup or rebuild appliance — do NOT attempt to clean
- Review Apache access logs at /var/log/httpd/https-access_log using vendor regex
- Check for unauthorized admin accounts, SSO/LDAP config changes, new push applications, policy changes
- Isolate EPMM from network if unable to patch within CISA 3-day deadline
Workarounds
- Restrict network access to EPMM management interfaces
- Monitor /mifs/c/appstore/fob/ and /mifs/c/aftstore/fob/ endpoints for anomalous 404 responses from external IPs
Longer-term hardening
- Upgrade to EPMM 12.8.0.0 when available (Q1 2026) for permanent fix
- Note: RPM hotfix does NOT survive version upgrades — must reapply
- Treat MDM systems as High-Value Assets with enhanced monitoring
- Review Ivanti Sentry logs for lateral movement indicators
- Implement off-device log forwarding to prevent attacker log tampering
CVEs associated with Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 /
Weaknesses (CWE) in Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 /
CWE-94
Timeline of Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 /
- CVE-2023-35078 and CVE-2023-35081 disclosed in Ivanti EPMM (MobileIron Core). Pre-authentication access vulnerability chained with local RCE. Actively exploited against Norwegian government ministries — 12 government agencies compromised via their MDM platform. Norwegian NCSC and CISA issue emergency advisories. Establishes EPMM as a high-value target for state-sponsored actors.
- CVE-2024-21887 and CVE-2023-46805 disclosed in Ivanti Connect Secure (ICS) VPN. Authentication bypass chained with command injection for pre-auth RCE. Mass exploitation by multiple threat actors including UNC5221 (suspected Chinese state-sponsored). CISA Emergency Directive ED-24-01 orders federal agencies to disconnect Ivanti VPN appliances. Demonstrates systematic targeting of Ivanti edge devices across product lines.
- CVE-2024-8963 disclosed in Ivanti Cloud Services Appliance (CSA). Admin bypass vulnerability chained with other CVEs for full compromise. Extends the Ivanti exploitation pattern to a third product line. Security community recognizes Ivanti products as a persistent strategic attack surface for advanced adversaries.
- CVE-2026-1281 discovered in Ivanti EPMM — pre-authentication Remote Code Execution via deserialization vulnerability in the device enrollment API. CVSS 9.8 (Critical). Active exploitation detected targeting government and defense organizations in Europe and North America. Exploitation grants root access to EPMM server and administrative control over ALL managed mobile devices.
- Ivanti releases EPMM version 12.3.0.1 patching CVE-2026-1281. Advisory recommends immediate patching and IOC checking. CISA adds to Known Exploited Vulnerabilities catalog with mandatory federal patching deadline. Organizations begin discovering they were compromised before the patch was available — zero-day exploitation window estimated at 2-4 weeks.
- Security vendors publish post-exploitation analysis: compromised EPMM servers used to enumerate managed device fleets, extract configuration profiles containing credentials, deploy persistent backdoors, and in some cases manipulate device policies. Evidence of follow-on exploitation of managed mobile devices via modified configuration profiles. The MDM-as-pivot scenario confirmed in multiple victim environments.
- Active exploitation continues against unpatched instances. Shodan identifies EPMM management interfaces still exposed to internet. Post-compromise remediation complex: requires full device fleet credential rotation, enrollment certificate revocation, and managed device integrity verification. Organizations that relied on EPMM for device security now face the paradox of their security platform being the compromise vector.
- As of 2026-05-29, CVE-2026-1281/1340 (Ivanti EPMM RCE, CVSS 9.8) is patched and in CISA KEV (due Feb 1), but mass, mostly-automated multi-actor exploitation of unpatched internet-facing instances continues with backdoors surviving patches. Unit 42 ceased monitoring Mar 24 and reporting is explicitly unattributed, undercutting the record's China/UNC5221 (low-confidence) claim.
Sources cited for Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 /
Threats related to Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 /
Detection coverage for TL-2026-0002
As of 2026-01-29, Threadlinqs Intelligence publishes 15 detection rule(s) for TL-2026-0002 across Splunk SPL, Microsoft KQL and Sigma, covering 55 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.