# Ivanti EPMM Pre-Auth Remote Code Execution (CVE-2026-1281 / CVE-2026-1340)

> CVE-2026-1281 is a critical pre-authentication Remote Code Execution (RCE) vulnerability in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core), affecting versions prior to 12.3.0.1. The vulnerability allows an unauthenticated attacker to achieve full remote code execution on the EPMM server via crafted API requests to the device management interface. CVSS 9.8 (Critical). Ivanti EPMM is a Mobile Device Management (MDM) platform used by enterprises, government agencies, and military organizations worldwide to manage and secure mobile device fleets — making it a HIGH-VALUE TARGET because compromising the MDM server grants control over all managed mobile devices. The vulnerability was discovered being actively exploited in the wild by suspected state-sponsored actors targeting government and defense organizations. Exploitation grants root-level access to the EPMM server, enabling: enumeration and control of all managed mobile devices, access to device configuration profiles including WiFi credentials and VPN configurations, email account access through managed profiles, location tracking of all enrolled devices, remote wipe capability, and lateral movement into the enterprise network. Ivanti products have been repeatedly targeted by sophisticated adversaries: CVE-2023-35078 and CVE-2023-35081 (MobileIron/EPMM), CVE-2024-21887 and CVE-2023-46805 (Connect Secure VPN), and CVE-2024-8963 (CSA). The pattern demonstrates that Ivanti edge devices are a STRATEGIC ATTACK SURFACE for nation-state actors seeking access to enterprise and government networks.

- **Published:** 2026-01-29T21:52:00Z
- **Last reviewed:** 2026-01-29T21:52:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0002
- **ID:** TL-2026-0002
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 15 · **IOCs:** 55 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-1281, CVE-2026-1340, CVE-2023-35078, CVE-2023-35081, CVE-2023-46805, CVE-2024-21887, CVE-2024-8963

## Description

CVE-2026-1281 represents the continuation of a persistent pattern: Ivanti enterprise security products being compromised to gain access to the organizations they are supposed to protect.

**The Product — Ivanti EPMM:**

Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, is an enterprise Mobile Device Management (MDM) platform that:
- Manages and secures mobile device fleets (iOS, Android, Windows) across enterprises
- Controls device enrollment, configuration profiles, app deployment, and security policies
- Stores device credentials (WiFi, VPN, email configurations)
- Provides remote lock, wipe, and location tracking capabilities
- Used by Fortune 500 companies, government agencies, defense organizations, and military
- Deployed as an on-premises appliance or cloud-hosted service
- Manages thousands to hundreds of thousands of devices per deployment

Compromising the EPMM server is equivalent to compromising EVERY mobile device it manages.

**The Vulnerability — CVE-2026-1281:**

- **Type**: Pre-authentication Remote Code Execution
- **CVSS**: 9.8 (Critical)
- **Vector**: Network-accessible API endpoint, no credentials required
- **Root Cause**: Improper input validation in the device enrollment API leading to deserialization of untrusted data
- **Exploitation**: Crafted HTTP request to the enrollment endpoint triggers code execution as root/SYSTEM on the EPMM appliance
- **Complexity**: Low — reliable exploitation achievable with single HTTP request
- **Affected Versions**: Ivanti EPMM prior to 12.3.0.1
- **Patch Available**: Yes — Ivanti EPMM 12.3.0.1 and later

**Exploitation in the Wild:**

Active exploitation was detected targeting:
- Government agencies in Europe and North America
- Defense contractors managing classified device fleets
- Healthcare organizations managing clinical devices
- Financial institutions managing corporate mobile fleets

The exploitation pattern matches sophisticated, targeted operations:
- Scanning for exposed EPMM instances on internet-facing management interfaces
- Single-request exploitation achieving root access
- Post-exploitation: enumeration of managed device fleet, extraction of configuration profiles, deployment of persistent backdoors
- Evidence of follow-on activity against managed mobile devices (configuration profile manipulation, credential extraction)

**Post-Exploitation Impact — MDM as Pivot:**

1. **Device Fleet Control**: Attacker gains administrative control over ALL managed mobile devices — can push malicious profiles, extract credentials, deploy surveillance
2. **Credential Harvest**: MDM stores WiFi credentials, VPN configurations, email account settings, certificate private keys — all extractable from compromised server
3. **Location Surveillance**: MDM can track real-time location of all enrolled devices — intelligence goldmine for state-sponsored actors targeting government officials
4. **Communication Access**: Managed email profiles grant access to organizational email through device management APIs
5. **Lateral Movement**: MDM server sits at the intersection of mobile and enterprise networks — compromised server enables network pivoting
6. **Remote Wipe Weapon**: Attacker can remotely wipe ALL managed devices simultaneously — destructive capability affecting thousands of devices
7. **Persistent Access**: Backdoors on MDM server persist through mobile device policy updates, affecting all future device enrollments

**Ivanti Product Exploitation History:**

Ivanti products represent a PATTERN of strategic compromise:
- **CVE-2023-35078 + CVE-2023-35081** (Jul 2023): EPMM/MobileIron pre-auth access + RCE. Exploited against Norwegian government ministries.
- **CVE-2024-21887 + CVE-2023-46805** (Jan 2024): Connect Secure VPN auth bypass + RCE chain. Mass exploitation by multiple threat actors including suspected Chinese state-sponsored groups.
- **CVE-2024-8963** (Sep 2024): Cloud Services Appliance (CSA) admin bypass. Chained with other vulns for full compromise.
- **CVE-2026-1281** (Current): EPMM pre-auth RCE. Continues the pattern of critical pre-auth vulnerabilities in enterprise edge devices.

The consistent targeting of Ivanti products reflects adversary STRATEGIC PRIORITIZATION: these devices sit at network boundaries, are internet-facing by design, and provide access to the most sensitive enterprise assets (mobile devices, VPN connections, cloud services).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1098 Account Manipulation
- T1685.006 Clear Linux or Mac System Logs
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1087 Account Discovery
- T1213 Data from Information Repositories
- T1210 Exploitation of Remote Services
- T1071.001 Web Protocols
- T1090.003 Multi-hop Proxy
- T1041 Exfiltration Over C2 Channel
- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1587 Develop Capabilities
- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1485 Data Destruction

## Sources

- [Ivanti Security](https://www.ivanti.com/security)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NIST NVD — CVE-2026-1281](https://nvd.nist.gov/vuln/detail/CVE-2026-1281)
- [CISA Emergency Directive](https://www.cisa.gov/)
- [Mandiant — Ivanti Campaign Analysis](https://www.mandiant.com/)
- [Volexity — EPMM Post-Exploitation](https://www.volexity.com/)
- [Norwegian NCSC — EPMM Advisory](https://www.ncsc.no/)
- [MITRE ATT&CK — Edge Device Exploitation](https://attack.mitre.org/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0002