Ivanti EPMM Unauthenticated RCE via Code Injection — CVE-2026-1281 & CVE-2026-1340 (Sleeper Shells)
Ivanti EPMM Unauthenticated RCE via Code Injection (TL-2026-0223), also tracked as Sleeper Shells, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-13. It has no confirmed attribution, affects Ivanti Endpoint Manager Mobile (EPMM), references 2 CVEs (CVE-2026-1281, CVE-2026-1340), maps to 16 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0223
- Threat ID
- TL-2026-0223
- Also known as
- Sleeper Shells, Ivanti EPMM Sleeper Shell Campaign
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-03-13
- Last reviewed
- 2026-03-13
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- government, healthcare, financial, education, technology, defense, telecommunications
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 15
Two critical unauthenticated remote code execution vulnerabilities (CVE-2026-1281, CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) versions through 12.7.0.0 are being actively exploited in the wild. Threat actors deploy dormant Java class loader webshells at /mifs/403.jsp to execute credential dumping, LDAP configuration exfiltration, and system archive theft. CISA KEV listed with CVSS 9.8.
How Ivanti EPMM Unauthenticated RCE via Code Injection works
CVE-2026-1281 and CVE-2026-1340 are code injection vulnerabilities (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM) that allow unauthenticated remote code execution. Both vulnerabilities carry a CVSS 3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting the trivial exploitation requirements and maximum impact across confidentiality, integrity, and availability.
The exploit chain results in deployment of an in-memory Java class loader webshell at the path /mifs/403.jsp on affected EPMM appliances. The webshell accepts commands through HTTP GET parameters — primarily the 'k' parameter which carries URL-encoded and Base64-encoded Java class files. A second parameter 'k0f53cf964d387' was observed in approximately 140 requests, though these did not result in dynamic code execution. The decoded Java classes retrieve servlet request/response objects and execute hardcoded commands via java.lang.Runtime.exec(String[] cmdarray) with elevated privileges using /bin/sh -p.
Post-exploitation activity follows a consistent four-stage pattern executed in sequential blocks, observed at least 7 times across compromised hosts:
1. Database Credential Dumping: mysqldump targeting the 'mifs' database, specifically tables mi_user (user credentials), mifs_ldap_users (LDAP user accounts), and mifs_ldap_server_config (LDAP server configurations). Output written to /mi/tomcat/webapps/mifs/css/mibasecss.css — disguised as a CSS file in the web-accessible directory.
2. System Configuration Archive: The /mi/tomcat-properties directory is compressed via tar -czvf and written to /mi/tomcat/webapps/mifs/css/mibasecss3.css, capturing Tomcat configuration and properties files.
3. System Files Archive: The /mi/files/system directory is archived to /mi/tomcat/webapps/mifs/css/mibasecss2.css, capturing additional system-level configuration.
4. Anti-Forensic Cleanup: All exfiltration staging files matching /mi/tomcat/webapps/mifs/css/mibasecss* are deleted using rm -f, removing evidence of the data staging.
The exfiltrated data — credentials, LDAP configurations, and system files — is staged in the web-accessible /mifs/css/ directory disguised as CSS files, allowing the attacker to retrieve the data via simple HTTP GET requests before cleanup occurs.
Exploitation activity was first observed on February 3-4, 2026, shortly after Ivanti published their security advisory and CISA added both CVEs to the Known Exploited Vulnerabilities catalog on January 29, 2026. The Defused threat intelligence team published an initial analysis of the 'Sleeper Shells' campaign on February 9, 2026. NVISO Labs published a detailed technical analysis of the webshell mechanics and post-exploitation behavior on March 13, 2026.
All versions of Ivanti EPMM through 12.7.0.0 are affected, including 12.5.0.0, 12.5.1.0, 12.6.0.0, and 12.6.1.0. Organizations running any of these versions should treat their EPMM instances as potentially compromised and follow Ivanti's remediation guidance immediately.
MITRE ATT&CK techniques used in TL-2026-0223
credential-access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
collection
T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
discovery
T1082 System Information Discovery; T1087 Account Discovery
initial-access
T1190 Exploit Public-Facing Application
persistence
Affected products and versions in Ivanti EPMM Unauthenticated RCE via Code Injection
- Ivanti — Endpoint Manager Mobile (EPMM)
Vulnerable versions: 12.5.0.0; 12.5.1.0; 12.6.0.0; 12.6.1.0; 12.7.0.0
Fixed in: Post-12.7.0.0 (per vendor advisory)
Remediation for Ivanti EPMM Unauthenticated RCE via Code Injection
Patches
- Apply Ivanti EPMM security update per advisory: Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340
- Update to EPMM version post-12.7.0.0 as directed by Ivanti
Immediate actions
- Patch Ivanti EPMM to the latest version per vendor advisory immediately
- Search all EPMM instances for the presence of /mifs/403.jsp webshell
- Review web server access logs for requests to /mifs/403.jsp with k or k0f53cf964d387 parameters
- Check for suspicious CSS files in /mi/tomcat/webapps/mifs/css/ directory (mibasecss.css, mibasecss2.css, mibasecss3.css)
- Block external access to EPMM management interfaces until patching is confirmed
- Reset all credentials stored in the mifs database including LDAP configurations
Workarounds
- Restrict network access to EPMM management interface to trusted IP ranges only
- Implement WAF rules to block requests containing Base64-encoded Java class payloads
- Monitor and alert on any new .jsp file creation in /mifs/ directory
- Discontinue use of the product if mitigations are unavailable per CISA BOD 22-01
Longer-term hardening
- Deploy web application firewall rules to detect code injection attempts against EPMM
- Implement network segmentation to restrict EPMM management access to authorized networks only
- Enable file integrity monitoring on EPMM web application directories
- Establish continuous vulnerability scanning for all Ivanti products
- Review and harden LDAP configurations that may have been exposed
- Consider complete EPMM instance rebuild if compromise indicators are found
CVEs associated with Ivanti EPMM Unauthenticated RCE via Code Injection
Weaknesses (CWE) in Ivanti EPMM Unauthenticated RCE via Code Injection
CWE-94
Timeline of Ivanti EPMM Unauthenticated RCE via Code Injection
- NVD publishes CVE-2026-1281 and CVE-2026-1340 entries with CVSS 9.8 Critical ratings
- Ivanti publishes security advisory for CVE-2026-1281 and CVE-2026-1340 affecting EPMM through version 12.7.0.0
- CISA adds CVE-2026-1281 and CVE-2026-1340 to the Known Exploited Vulnerabilities catalog with remediation due date of 2026-02-01
- CISA BOD 22-01 remediation deadline for federal agencies to apply patches or discontinue product use
- Earliest observed exploitation activity — threat actors begin deploying webshell at /mifs/403.jsp on vulnerable EPMM instances
- Active webshell deployment confirmed across multiple EPMM instances with credential dumping and data exfiltration activity
- Defused publishes initial threat intelligence blog identifying the Sleeper Shells campaign targeting EPMM via 403.jsp webshells
- Observed exploitation window: approximately 140 requests with k0f53cf964d387 parameter and 30+ requests with k parameter between Feb 3-11
- NVD updates CVE-2026-1340 entry with additional analysis information
- NVISO Labs publishes detailed technical analysis of Sleeper Shells webshell mechanics, payload decoding, and post-exploitation behavior
- As of 2026-05-29, the Ivanti EPMM RCE flaws (CVE-2026-1281/1340, CISA KEV, CVSS 9.8) are patched via temporary RPMs and the permanent 12.8.0.0 fix, and mass exploitation tapered after the early-Feb GreyNoise spike (269 sessions Feb 8, near-zero Feb 9). The unattributed "Sleeper Shells" campaign staged dormant in-memory 403.jsp backdoors for possible reactivation, so residual risk on unpatched/compromised hosts keeps it under monitoring rather than fully resolved.
Sources cited for Ivanti EPMM Unauthenticated RCE via Code Injection
- NVISO Labs: Ivanti EPMM Sleeper Shells — Not So Sleepy
- NVD — CVE-2026-1281
- NVD — CVE-2026-1340
- Ivanti Security Advisory — EPMM CVE-2026-1281 & CVE-2026-1340
- CISA KEV Catalog — CVE-2026-1281
- Defused: Ivanti EPMM Sleeper Shells and 403.jsp Campaign Analysis
- CISA BOD 22-01 — Reducing the Significant Risk of Known Exploited Vulnerabilities
Threats related to Ivanti EPMM Unauthenticated RCE via Code Injection
Detection coverage for TL-2026-0223
As of 2026-03-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0223 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.