CSO Online

Dark Reading

IT Security Guru

Recent cyberattacks exploiting critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, in Ivanti Endpoint Manager Mobile (EPMM) have led to significant breaches across governments, healthcare, manufacturing, and other sectors worldwide. These vulnerabilities, both carrying a CVSS score of 9.8, allow attackers to achieve unauthenticated remote code execution on exposed Mobile Device Management (MDM) servers. Over 4,400 instances are publicly accessible, making them prime targets for threat actors deploying web shells, cryptominers, and persistent backdoors that can survive patching cycles.
Ivanti has responded with emergency RPM patches for EPMM version 12.x; however, the patches do not persist through version upgrades, and connected Sentry systems may also be at risk. Organizations are advised to restore systems from clean backups and initiate incident response processes if a compromise is suspected, as patching alone may not suffice.
The EU Commission’s MDM system, targeted in late January, was contained within nine hours with minimal data exposure. Similar breaches affected Dutch government agencies, with personal data, including staff names and business contact information, being accessed. Germany and the US see the highest number of compromised instances.
Security experts emphasize robust security measures such as reducing public interface exposure, enforcing strong authentication, and treating perimeter systems as Tier-0 critical infrastructure. As organizations continue to grapple with Ivanti’s repeated vulnerability history, the necessity of a strong defense-in-depth strategy becomes apparent, accompanied by a shift towards continuous monitoring and zero-trust architectures.

Collections

Critical zero-day vulnerabilities CVE-2026-1281 and CVE-2026-1340 in Ivanti EPMM (CVSS 9.8) are being actively exploited, enabling unauthenticated remote code execution on MDM servers. Over 4,400 publicly exposed instances have been targeted across government, healthcare, and manufacturing sectors, with notable breaches at the EU Commission and Dutch government agencies. Ivanti released emergency RPM patches for EPMM 12.x, but patches don't survive version upgrades and connected Sentry systems remain at risk. Security experts recommend reducing public exposure, enforcing strong authentication, restoring from clean backups if compromised, and adopting defense-in-depth and zero-trust strategies.

Cyberattacks Exploit Ivanti Vulnerabilities Affecting EU and Dutch Authorities