Ivanti Discloses Two Critical EPMM Vulnerabilities with Active Exploitation Ivanti has revealed two critical vulnerabilities in its Endpoint Manager Mobile (EPMM) software, tracked as CVE-2026-1281 and CVE-2026-1340, both carrying a CVSS score of 9.8. The flaws stem from code injection issues and enable unauthenticated remote code execution (RCE) with no user interaction or additional privileges required only network access. The vulnerabilities affect multiple EPMM versions, including 12.5.0.0, 12.6.0.0, 12.7.0.0, 12.5.1.0, and 12.6.1.0, but do not impact other Ivanti products, such as Ivanti Neurons for MDM or Ivanti Endpoint Manager (EPM). Cloud-based deployments with Sentry integration remain unaffected. Ivanti has confirmed active exploitation in a limited number of customer environments, underscoring the urgency of remediation. The company has released version-specific RPM patches for affected deployments, which can be applied without downtime. However, the patches do not persist through upgrades, requiring reinstallation after version changes. A permanent fix will be included in EPMM 12.8.0.0, scheduled for release in Q1 2026. For heightened security, Ivanti recommends rebuilding the EPMM appliance and migrating data, avoiding the need for device re-enrollment. Organizations are advised to prioritize patching due to the low attack complexity, unauthenticated access, and confirmed exploitation. Early adoption of EPMM 12.8.0.0 is encouraged to eliminate recurring patch reapplications.