# Ivanti EPMM Dual-CVE Unauthenticated RCE Chain (CVE-2026-1281 + CVE-2026-1340) — CVSS 9.8, CISA KEV, Dutch Government Breached, Bulletproof Hosting IAB, Sleeper Webshells, 28K+ Attacking IPs

> Dual CVSS 9.8 unauthenticated RCE vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) under mass exploitation by initial access broker on bulletproof hosting, with confirmed Dutch government breaches and sleeper webshell deployment at scale.

- **Published:** 2026-02-16T16:35:06Z
- **Last reviewed:** 2026-07-19T10:41:45.024Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0121
- **ID:** TL-2026-0121
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Actor:** UNC5221 (China)
- **Detections:** 12 · **IOCs:** 63 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-1281, CVE-2026-1340

## Description

CVE-2026-1281 and CVE-2026-1340 are two critical code injection vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0. CVE-2026-1281 exploits Bash arithmetic expansion in EPMM's file delivery mechanism at the /mifs/c/appstore/fob/ endpoint, allowing unauthenticated attackers to inject malicious payloads via URL parameters and execute arbitrary commands as the web server user. CVE-2026-1340 is a related code injection flaw in a different EPMM component (aftstore vs appstore packages). Both carry CVSS 9.8, require no authentication, and enable full remote code execution.

The exploitation campaign exhibits strong initial access broker (IAB) characteristics. GreyNoise telemetry recorded 417 exploitation sessions from 8 IPs between Feb 1-9, with 83% (346 sessions) originating from a single IP (193.24.123.42) on PROSPERO OOO bulletproof hosting (AS200593, Saint Petersburg, Russia). This IP was notably absent from widely published IOC lists, meaning defenders blocking only published indicators missed the dominant exploitation source. The IP simultaneously exploits four unrelated CVEs across Oracle WebLogic, GNU telnetd, Ivanti EPMM, and GLPI, rotating through 300+ user-agent strings — consistent with automated mass exploitation tooling.

85% of exploitation payloads used OAST (Out-of-Band Application Security Testing) DNS callbacks to verify command execution without immediately deploying malware — cataloging vulnerable targets for later exploitation rather than immediate compromise. Defused Cyber independently confirmed this IAB pattern: attackers deployed dormant in-memory Java class loaders to /mifs/403.jsp that wait for a specific trigger parameter (k0f53cf964d387) to activate. The implant (base.Info, compiled from Info.java) uses equals(Object) as entry point instead of standard servlet methods to evade detection, supports both modern and legacy JVMs, and fingerprints the host before handing off to a second-stage class loaded entirely in memory via ClassLoader#defineClass.

Dutch government institutions were confirmed compromised: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and the Council for the Judiciary (Raad voor de Rechtspraak, RVDR) were breached before most organizations had patched. Shadowserver observed 28,300+ unique source IPs attempting exploitation on Feb 9, with 72% from US-based infrastructure, followed by UK (3,800 IPs) and Russia (1,900 IPs). 56 IPs were confirmed compromised with webshells.

The exploitation timeline was unprecedented: Ivanti advisory, CISA KEV listing, and confirmed government compromise all occurred on January 29 — the same day. watchTowr Labs published full technical analysis by January 30, and PoC code appeared on GitHub shortly after. CISA issued an unprecedented 3-day remediation deadline. NHS England, CERT-EU, and NCSC-NL issued advisories confirming active exploitation.

EPMM manages mobile devices, applications, and content across enterprise environments. Successful compromise provides attackers with extensive control over corporate mobile infrastructure, including the ability to deploy additional payloads to managed devices and facilitate lateral movement — making MDM platforms equivalent in criticality to domain controllers. Ivanti has released temporary RPM patches for affected versions, with a permanent fix scheduled for version 12.8.0.0 in Q1 2026. The vendor recommends rebuilding EPMM environments and migrating data as the most conservative remediation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1505.003 Web Shell
- T1525 Implant Internal Image
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1620 Reflective Code Loading
- T1480 Execution Guardrails
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1071.001 Web Protocols
- T1071.004 DNS
- T1105 Ingress Tool Transfer
- T1583.005 Botnet
- T1584.004 Server
- T1036.005 Match Legitimate Resource Name or Location
- T1518 Software Discovery
- T1016 System Network Configuration Discovery
- T1571 Non-Standard Port
- T1588.005 Exploits
- T1583.004 Server
- T1531 Account Access Removal
- T1595 Active Scanning
- T1587 Develop Capabilities
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1496 Resource Hijacking

## Sources

- [GreyNoise: Active Ivanti Exploitation Traced to Single Bulletproof IP](https://www.greynoise.io/blog/active-ivanti-exploitation)
- [Defused Cyber: Sleeper Shells in Ivanti EPMM](https://defusedcyber.com/ivanti-epmm-sleeper-shells-403jsp)
- [Ivanti Security Advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340)
- [CISA KEV: CVE-2026-1281](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281)
- [NVD: CVE-2026-1281](https://nvd.nist.gov/vuln/detail/CVE-2026-1281)
- [NVD: CVE-2026-1340](https://nvd.nist.gov/vuln/detail/CVE-2026-1340)
- [Cyber Security News: Single IP Dominates EPMM Exploitation](https://cybersecuritynews.com/ivanti-epmm-rce-vulnerability-exploited/)
- [Cyber Security News: 28,300 IPs Attacking Ivanti EPMM](https://cybersecuritynews.com/ivanti-epmm-0-day-flaw-exploited/)
- [Cyber Security News: Dormant Backdoors in Ivanti EPMM](https://cybersecuritynews.com/ivanti-epmm-devices-exploited/)
- [Cyber Security News: Ivanti EPMM 0-day RCE Vulnerabilities](https://cybersecuritynews.com/ivanti-endpoint-manager-vulnerability/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0121