# Ivanti EPMM Unauthenticated RCE via Code Injection — CVE-2026-1281 & CVE-2026-1340 (Sleeper Shells)

> Two critical unauthenticated remote code execution vulnerabilities (CVE-2026-1281, CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) versions through 12.7.0.0 are being actively exploited in the wild. Threat actors deploy dormant Java class loader webshells at /mifs/403.jsp to execute credential dumping, LDAP configuration exfiltration, and system archive theft. CISA KEV listed with CVSS 9.8.

- **Published:** 2026-03-13T12:00:00Z
- **Last reviewed:** 2026-03-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0223
- **ID:** TL-2026-0223
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-1281, CVE-2026-1340

## Description

CVE-2026-1281 and CVE-2026-1340 are code injection vulnerabilities (CWE-94) in Ivanti Endpoint Manager Mobile (EPMM) that allow unauthenticated remote code execution. Both vulnerabilities carry a CVSS 3.1 base score of 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting the trivial exploitation requirements and maximum impact across confidentiality, integrity, and availability.

The exploit chain results in deployment of an in-memory Java class loader webshell at the path /mifs/403.jsp on affected EPMM appliances. The webshell accepts commands through HTTP GET parameters — primarily the 'k' parameter which carries URL-encoded and Base64-encoded Java class files. A second parameter 'k0f53cf964d387' was observed in approximately 140 requests, though these did not result in dynamic code execution. The decoded Java classes retrieve servlet request/response objects and execute hardcoded commands via java.lang.Runtime.exec(String[] cmdarray) with elevated privileges using /bin/sh -p.

Post-exploitation activity follows a consistent four-stage pattern executed in sequential blocks, observed at least 7 times across compromised hosts:

1. Database Credential Dumping: mysqldump targeting the 'mifs' database, specifically tables mi_user (user credentials), mifs_ldap_users (LDAP user accounts), and mifs_ldap_server_config (LDAP server configurations). Output written to /mi/tomcat/webapps/mifs/css/mibasecss.css — disguised as a CSS file in the web-accessible directory.

2. System Configuration Archive: The /mi/tomcat-properties directory is compressed via tar -czvf and written to /mi/tomcat/webapps/mifs/css/mibasecss3.css, capturing Tomcat configuration and properties files.

3. System Files Archive: The /mi/files/system directory is archived to /mi/tomcat/webapps/mifs/css/mibasecss2.css, capturing additional system-level configuration.

4. Anti-Forensic Cleanup: All exfiltration staging files matching /mi/tomcat/webapps/mifs/css/mibasecss* are deleted using rm -f, removing evidence of the data staging.

The exfiltrated data — credentials, LDAP configurations, and system files — is staged in the web-accessible /mifs/css/ directory disguised as CSS files, allowing the attacker to retrieve the data via simple HTTP GET requests before cleanup occurs.

Exploitation activity was first observed on February 3-4, 2026, shortly after Ivanti published their security advisory and CISA added both CVEs to the Known Exploited Vulnerabilities catalog on January 29, 2026. The Defused threat intelligence team published an initial analysis of the 'Sleeper Shells' campaign on February 9, 2026. NVISO Labs published a detailed technical analysis of the webshell mechanics and post-exploitation behavior on March 13, 2026.

All versions of Ivanti EPMM through 12.7.0.0 are affected, including 12.5.0.0, 12.5.1.0, 12.6.0.0, and 12.6.1.0. Organizations running any of these versions should treat their EPMM instances as potentially compromised and follow Ivanti's remediation guidance immediately.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074 Data Staged
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1070 Indicator Removal
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1087 Account Discovery

## Sources

- [NVISO Labs: Ivanti EPMM Sleeper Shells — Not So Sleepy](https://blog.nviso.eu/2026/03/13/ivanti-epmm-sleeper-shells-not-so-sleepy/)
- [NVD — CVE-2026-1281](https://nvd.nist.gov/vuln/detail/CVE-2026-1281)
- [NVD — CVE-2026-1340](https://nvd.nist.gov/vuln/detail/CVE-2026-1340)
- [Ivanti Security Advisory — EPMM CVE-2026-1281 & CVE-2026-1340](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340)
- [CISA KEV Catalog — CVE-2026-1281](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281)
- [Defused: Ivanti EPMM Sleeper Shells and 403.jsp Campaign Analysis](https://defused.io/ivanti-epmm-sleeper-shells)
- [CISA BOD 22-01 — Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/binding-operational-directive-22-01)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0223