Ivanti EPMM Dual-CVE Unauthenticated RCE Chain (CVE-2026-1281 + CVE-2026-1340) — CVSS 9.8, CISA KEV, Dutch Government Breached, Bulletproof Hosting IAB, Sleeper Webshells, 28K+ Attacking IPs

Ivanti EPMM Dual-CVE Unauthenticated RCE Chain (TL-2026-0121) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-02-16 and last reviewed 2026-07-19. It is attributed to UNC5221 (China) with medium confidence, references 2 CVEs (CVE-2026-1281, CVE-2026-1340), maps to 35 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 12 detection rules and 63 indicators of compromise.

Key facts for TL-2026-0121

Threat ID
TL-2026-0121
Severity
CRITICAL
CVSS
9.8
Status
PATCHED
Category
VULNERABILITY
First published
2026-02-16
Last reviewed
2026-07-19
Attribution
UNC5221
Attribution confidence
MEDIUM
Nation-state nexus
China
Motivation
financial
Target sectors
government, enterprise, technology, healthcare, education
Target regions
Netherlands, Europe, Global
Detection rules
12
Indicators of compromise
63
Updates
2026-07-19 · 2 updates · revalidated 2× · latest source

Dual CVSS 9.8 unauthenticated RCE vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) under mass exploitation by initial access broker on bulletproof hosting, with confirmed Dutch government breaches and sleeper webshell deployment at scale.

How Ivanti EPMM Dual-CVE Unauthenticated RCE Chain works

CVE-2026-1281 and CVE-2026-1340 are two critical code injection vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0. CVE-2026-1281 exploits Bash arithmetic expansion in EPMM's file delivery mechanism at the /mifs/c/appstore/fob/ endpoint, allowing unauthenticated attackers to inject malicious payloads via URL parameters and execute arbitrary commands as the web server user. CVE-2026-1340 is a related code injection flaw in a different EPMM component (aftstore vs appstore packages). Both carry CVSS 9.8, require no authentication, and enable full remote code execution.

The exploitation campaign exhibits strong initial access broker (IAB) characteristics. GreyNoise telemetry recorded 417 exploitation sessions from 8 IPs between Feb 1-9, with 83% (346 sessions) originating from a single IP (193.24.123.42) on PROSPERO OOO bulletproof hosting (AS200593, Saint Petersburg, Russia). This IP was notably absent from widely published IOC lists, meaning defenders blocking only published indicators missed the dominant exploitation source. The IP simultaneously exploits four unrelated CVEs across Oracle WebLogic, GNU telnetd, Ivanti EPMM, and GLPI, rotating through 300+ user-agent strings — consistent with automated mass exploitation tooling.

85% of exploitation payloads used OAST (Out-of-Band Application Security Testing) DNS callbacks to verify command execution without immediately deploying malware — cataloging vulnerable targets for later exploitation rather than immediate compromise. Defused Cyber independently confirmed this IAB pattern: attackers deployed dormant in-memory Java class loaders to /mifs/403.jsp that wait for a specific trigger parameter (k0f53cf964d387) to activate. The implant (base.Info, compiled from Info.java) uses equals(Object) as entry point instead of standard servlet methods to evade detection, supports both modern and legacy JVMs, and fingerprints the host before handing off to a second-stage class loaded entirely in memory via ClassLoader#defineClass.

Dutch government institutions were confirmed compromised: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and the Council for the Judiciary (Raad voor de Rechtspraak, RVDR) were breached before most organizations had patched. Shadowserver observed 28,300+ unique source IPs attempting exploitation on Feb 9, with 72% from US-based infrastructure, followed by UK (3,800 IPs) and Russia (1,900 IPs). 56 IPs were confirmed compromised with webshells.

The exploitation timeline was unprecedented: Ivanti advisory, CISA KEV listing, and confirmed government compromise all occurred on January 29 — the same day. watchTowr Labs published full technical analysis by January 30, and PoC code appeared on GitHub shortly after. CISA issued an unprecedented 3-day remediation deadline. NHS England, CERT-EU, and NCSC-NL issued advisories confirming active exploitation.

EPMM manages mobile devices, applications, and content across enterprise environments. Successful compromise provides attackers with extensive control over corporate mobile infrastructure, including the ability to deploy additional payloads to managed devices and facilitate lateral movement — making MDM platforms equivalent in criticality to domain controllers. Ivanti has released temporary RPM patches for affected versions, with a permanent fix scheduled for version 12.8.0.0 in Q1 2026. The vendor recommends rebuilding EPMM environments and migrating data as the most conservative remediation.

MITRE ATT&CK techniques used in TL-2026-0121

collection

T1005 Data from Local System; T1213 Data from Information Repositories

discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery; T1518 Software Discovery

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1620 Reflective Code Loading

execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1203 Exploitation for Client Execution

command-and-control

T1071.001 Web Protocols; T1071.004 DNS; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

impact

T1496 Resource Hijacking; T1531 Account Access Removal

persistence

T1505.003 Web Shell; T1525 Implant Internal Image; T1543 Create or Modify System Process

privilege-escalation

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

credential-access

T1552 Unsecured Credentials

resource-development

T1583.004 Server; T1583.005 Botnet; T1584.004 Server; T1587 Develop Capabilities; T1588.005 Exploits

Reconnaissance

T1595 Active Scanning

Remediation for Ivanti EPMM Dual-CVE Unauthenticated RCE Chain

Patches

  • Ivanti RPM patches for EPMM 12.5.0.x through 12.7.0.x (available now)
  • Permanent fix: EPMM version 12.8.0.0 (scheduled Q1 2026)
  • RPM script must be reapplied after version upgrades

Immediate actions

  • Apply version-specific RPM patches immediately (12.5.0.x through 12.7.0.x)
  • Restart affected EPMM application servers to flush in-memory implants
  • Block AS200593 (PROSPERO OOO) at network perimeter
  • Hunt for /mifs/403.jsp and parameter k0f53cf964d387 in access logs
  • Review DNS logs for OAST-pattern callbacks (high-entropy subdomains)
  • If EPMM was internet-facing and unpatched between Jan 29 and patch date, assume compromise and investigate

Workarounds

  • Restrict EPMM access to known network ranges or require VPN authentication
  • Network-level blocking of exploitation source IPs and AS200593
  • Monitor /mifs/ directory for unexpected JSP files

Longer-term hardening

  • Place MDM infrastructure behind VPN or zero-trust network access — never directly internet-facing
  • Treat MDM platforms with same criticality as domain controllers
  • Implement IOC confidence-scoring framework (bulletproof hosting vs shared VPN exits)
  • Consider rebuilding EPMM environments and migrating data (Ivanti's recommended conservative approach)
  • Monitor for unauthorized device enrollments and configuration changes
  • Deploy network isolation for MDM infrastructure

CVEs associated with Ivanti EPMM Dual-CVE Unauthenticated RCE Chain

CVE-2026-1281, CVE-2026-1340

Weaknesses (CWE) in Ivanti EPMM Dual-CVE Unauthenticated RCE Chain

CWE-94, CWE-95, CWE-78

Timeline of Ivanti EPMM Dual-CVE Unauthenticated RCE Chain

  • NHS England, CERT-EU, and NCSC-NL issue advisories confirming active exploitation of Ivanti EPMM vulnerabilities. Source: https://www.greynoise.io/blog/active-ivanti-exploitation
  • Dutch authorities confirm breaches at Dutch Data Protection Authority (AP) and Council for the Judiciary (RVDR) via Ivanti EPMM exploitation. Attacks occurred before vendor disclosure. Source: https://cybersecuritynews.com/ivanti-epmm-0-day-flaw-exploited/
  • CISA adds CVE-2026-1281 to Known Exploited Vulnerabilities catalog with unprecedented 3-day remediation deadline (due Feb 1). Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • Ivanti publishes security advisory for CVE-2026-1281 and CVE-2026-1340, acknowledging limited in-the-wild exploitation. Source: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340
  • watchTowr Labs publishes full technical analysis of CVE-2026-1281 Bash arithmetic expansion exploitation. PoC code appears on GitHub shortly after. Source: https://www.greynoise.io/blog/active-ivanti-exploitation
  • CISA-mandated federal civilian remediation deadline for CVE-2026-1281 passes. Source: watchTowr Labs.
  • GreyNoise sensors first detect CVE-2026-1281 exploitation attempts — 2 sessions on day one, three days after disclosure. Source: https://www.greynoise.io/blog/active-ivanti-exploitation
  • Defused Cyber observes coordinated campaign deploying dormant in-memory Java class loaders (base.Info) to /mifs/403.jsp on compromised EPMM instances. No follow-on exploitation observed. Source: https://defusedcyber.com/ivanti-epmm-sleeper-shells-403jsp
  • Dutch authorities seize Windscribe VPN server in Netherlands as part of undisclosed investigation. Windscribe confirms RAM-only architecture — no user data recoverable. Not publicly linked to Ivanti campaign. Source: https://www.greynoise.io/blog/active-ivanti-exploitation
  • GreyNoise records 269 exploitation sessions in single day — 13x the daily average of preceding week. Sharp acceleration indicates expanded targeting scope. Source: https://www.greynoise.io/blog/active-ivanti-exploitation
  • Defused Cyber publishes technical analysis of sleeper shell campaign: base.Info in-memory class loader, trigger parameter k0f53cf964d387, response delimiters 3cd3d/e60537. Assessed as initial access broker tradecraft. Source: https://defusedcyber.com/ivanti-epmm-sleeper-shells-403jsp
  • GreyNoise publishes detailed analysis: 417 exploitation sessions from 8 IPs, 83% from single PROSPERO OOO bulletproof hosting IP (193.24.123.42). Published IOC lists miss dominant exploitation source. Source: https://www.greynoise.io/blog/active-ivanti-exploitation
  • Shadowserver scans reveal 28,300+ unique source IPs attempting CVE-2026-1281 exploitation — one of the largest coordinated attack campaigns against enterprise MDM infrastructure in 2026. 56 IPs confirmed compromised with webshells. Source: https://cybersecuritynews.com/ivanti-epmm-0-day-flaw-exploited/
  • Unit 42 concludes active monitoring, having tracked roughly 4,400 internet-exposed EPMM instances targeted (predominantly US, plus Germany, Australia, Canada) across government, healthcare, manufacturing, legal, and technology sectors. Observed post-exploitation: Behinder web shells (default AES key 45e329feb5d925b), Nezha C2-adjacent agent via Gitee config, cryptominers, SUID escalation attempts. Source: https://unit42.paloaltonetworks.com/ivanti-cve-2026-1281-cve-2026-1340/
  • CISA separately adds CVE-2026-1340 to the Known Exploited Vulnerabilities catalog (CVE-2026-1281 was added on 2026-01-29).
  • As of 2026-05-29, CVE-2026-1281/1340 in Ivanti EPMM are remediated: interim RPM patches shipped on disclosure (Jan 29) and the permanent fix in EPMM 12.8.0.0 released in Q1 2026, while CISA's 3-day KEV deadline (Feb 1) long passed. Mass exploitation peaked in Feb (NVISO confirmed data-exfil variants by mid-March), but no new campaigns are reported in May, so activity is residual against unpatched hosts.

Update history for TL-2026-0121

Sources cited for Ivanti EPMM Dual-CVE Unauthenticated RCE Chain

Threats related to Ivanti EPMM Dual-CVE Unauthenticated RCE Chain

Detection coverage for TL-2026-0121

As of 2026-07-19, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0121 across Splunk SPL, Microsoft KQL and Sigma, covering 63 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats