--- title: Critical Vulnerabilities in Ivanti EPMM Exploited description: Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile are being actively exploited to achieve remote code... canonical: https://daily.dev/posts/critical-vulnerabilities-in-ivanti-epmm-exploited-fc7ymasmr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Vulnerabilities in Ivanti EPMM Exploited | daily.dev og:description: Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile are being actively exploited to achieve remote code... og:url: https://daily.dev/posts/critical-vulnerabilities-in-ivanti-epmm-exploited-fc7ymasmr og:image: https://api.daily.dev/og/posts/fC7YmASMr.png og:image:alt: Critical Vulnerabilities in Ivanti EPMM Exploited og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Vulnerabilities in Ivanti EPMM Exploited **[Unit 42](https://daily.dev/sources/unit42)** · 9 min read · 0 upvotes · 0 comments ## Summary Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile are being actively exploited to achieve remote code execution on MDM servers. The flaws stem from unsafe bash arithmetic expansion in legacy Apache RewriteMap scripts. Attackers are deploying web shells, reverse shells, cryptominers, and persistent backdoors across government, healthcare, manufacturing, and tech sectors in multiple countries. Over 4,400 EPMM instances have been identified as potentially vulnerable. Ivanti has released version-specific RPM patches that require no downtime, and CISA has added CVE-2026-1281 to its Known Exploited Vulnerabilities catalog. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#apache](https://daily.dev/tags/apache), [#bash](https://daily.dev/tags/bash) [View this post on daily.dev](https://daily.dev/posts/critical-vulnerabilities-in-ivanti-epmm-exploited-fc7ymasmr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Vulnerabilities in Ivanti EPMM Exploited","url":"https://daily.dev/posts/critical-vulnerabilities-in-ivanti-epmm-exploited-fc7ymasmr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-vulnerabilities-in-ivanti-epmm-exploited-fc7ymasmr"},"datePublished":"2026-02-17T20:43:44.354Z","dateModified":"2026-02-26T18:02:59.856Z","description":"Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile are being actively exploited to achieve remote code...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/64cbf4e3a14201797c96ea844e54776f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/64cbf4e3a14201797c96ea844e54776f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-vulnerabilities-in-ivanti-epmm-exploited-fc7ymasmr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability,apache,bash","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"Critical Vulnerabilities in Ivanti EPMM Exploited"}]} ```