--- title: Attackers exploit Ivanti EPMM zero-days to seize control... description: Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild, both... canonical: https://daily.dev/posts/attackers-exploit-ivanti-epmm-zero-days-to-seize-control-of-mdm-servers-xzybra5hl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers | daily.dev og:description: Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild, both... og:url: https://daily.dev/posts/attackers-exploit-ivanti-epmm-zero-days-to-seize-control-of-mdm-servers-xzybra5hl og:image: https://api.daily.dev/og/posts/XZybra5hL.png og:image:alt: Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild, both carrying a CVSS score of 9.8. Attackers can gain unauthenticated remote code execution on exposed MDM servers, with over 4,400 instances publicly accessible. Threat actors are rapidly moving from automated scanning to deploying persistent backdoors, web shells, and cryptominers that survive patching cycles. Targeted sectors include government, healthcare, and manufacturing across the US, Germany, Australia, and Canada. Ivanti has released emergency RPM patches for EPMM 12.x, but warns the patch doesn't survive version upgrades and that connected Sentry systems may also be compromised. Organizations suspecting compromise are advised to restore from clean backups rather than attempting remediation. Proof-of-concept exploit code is already publicly available, and this follows a recurring pattern of Ivanti product exploitation dating back to 2023. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday](https://daily.dev/posts/cisa-orders-feds-to-patch-exploited-ivanti-epmm-flaw-by-sunday-q37rvz2h1) · BleepingComputer · 1 upvotes · 0 comments - [Sleeper Shells: How Attackers Are Planting Dormant Backdoors in Ivanti EPMM](https://daily.dev/posts/sleeper-shells-how-attackers-are-planting-dormant-backdoors-in-ivanti-epmm-czgk5a0b2) · Hacker News · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/attackers-exploit-ivanti-epmm-zero-days-to-seize-control-of-mdm-servers-xzybra5hl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers","url":"https://daily.dev/posts/attackers-exploit-ivanti-epmm-zero-days-to-seize-control-of-mdm-servers-xzybra5hl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/attackers-exploit-ivanti-epmm-zero-days-to-seize-control-of-mdm-servers-xzybra5hl"},"datePublished":"2026-02-23T10:34:15.340Z","dateModified":"2026-02-26T17:21:46.412Z","description":"Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild, both...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bf41843c2267e29187bcc0eda02c1c17?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bf41843c2267e29187bcc0eda02c1c17?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/attackers-exploit-ivanti-epmm-zero-days-to-seize-control-of-mdm-servers-xzybra5hl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,vulnerability,zero-day","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers"}]} ```