Ivanti EPMM Unauthenticated RCE via Code Injection — CVE-2026-1281 & CVE-2026-1340 (Sleeper Shells) — Threadlinqs Intelligence
As of 2026-05-30, Ivanti EPMM Unauthenticated RCE via Code Injection — CVE-2026-1281 & CVE-2026-1340 (Sleeper Shells) is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0223 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: VULNERABILITY
Attribution: N/A · ESPIONAGE
Two critical unauthenticated remote code execution vulnerabilities (CVE-2026-1281, CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) versions through 12.7.0.0 are being actively exploited in the
CVE-2026-1281 and CVE-2026-1340 are code injection vulnerabilities (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM) that allow unauthenticated remote code execution. Both vulnerabilities carry a CVSS 3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting the trivial exploitation requirements and maximum impact across confidentiality, integrity, and availability.
The exploit chain results in deployment of an in-memory Java class loader webshell at the path /mifs/403.jsp on affected EPMM appliances. The webshell accepts commands through HTTP GET parameters — primarily the 'k' parameter which carries URL-encoded and Base64-encoded Java class files. A second parameter 'k0f53cf964d387' was observed in approximately 140 requests, though these did not result in dynamic code execution. The decoded Java classes retrieve servlet request/response objects and execute hardcoded commands via java.lang.Runtime.exec(String[] cmdarray) with elevated privileges using /bin/sh -p.
Post-exploitation activity follows a consistent four-stage pattern executed in sequential blocks, observed at least 7 times across compromised hosts:
1. Database Credential Dumping: mysqldump targeting the 'mifs' database, specifically tables mi_user (user credentials), mifs_ldap_users (LDAP user accounts), and mifs_ldap_server_config (LDAP server configurations). Output written to /mi/tomcat/webapps/mifs/css/mibasecss.css — disguised as a CSS file in the web-accessible directory.
2. System Configuration Archive: The /mi/tomcat-properties directory is compressed via tar -czvf and written to /mi/tomcat/webapps/mifs/css/mibasecss3.css, capturing Tomcat configuration and properties files.
3. System Files Archive: The /mi/files/system directory is archived to /mi/tomcat/webapps/mifs/css/mibasecss2.css, capturing additional system-level configuration.
4. Anti-Forensic Cleanup: All exfiltration staging files matching /mi/tomcat/webapps/mifs/css/mibasecss* are deleted using rm -f, removing evidence of the data staging.
The exfiltrated data — credentials, LDAP configurations, and system files — is staged in the web-accessible /mifs/css/ directory disguised as CSS files, allowing the attacker to retrieve the data via simple HTTP GET requests before cleanup occurs.
Exploitation activity was first observed on February 3-4, 2026, shortly after Ivanti published their security advisory and CISA added both CVEs to the Known Exploited Vulnerabilities catalog on January 29, 2026. The Defused threat intelligence team published an initial analysis of the 'Sleeper Shells' campaign on February 9, 2026. NVISO Labs published a detailed technical analysis of the webshell mechanics and post-exploitation behavior on March 13, 2026.
All versions of Ivanti EPMM through 12.7.0.0 are affected, including 12.5.0.0, 12.5.1.0, 12.6.0.0, and 12.6.1.0. Organizations running any of these versions should treat their EPMM instances as potentially compromised and follow Ivanti's remediation guidance immediately.
Target sectors: government, healthcare, financial, education, technology, defense, telecommunications
Target regions: North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-1281, CVE-2026-1340, T1190, T1059, T1203, T1505, T1003, T1552, T1552, T1005, T1560, T1074