Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection

Exploited in the wild. Listed by CISA on 2026-01-29; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system.

Impact

Unauthenticated remote attackers can execute arbitrary code on the EPMM appliance, leading to full system compromise. This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Fix

Apply the Ivanti security patch for EPMM or upgrade to a version above 12.7.0.0. Restrict network access to the EPMM management interface.

How to confirm it

Send: GET /mics/login.jsp
Positive when: contains(body, "<title>Ivanti System Manager: Sign In") and contains(body, "Ivanti. All rights reserved.") AND (compare_versions(version, ">= 12.5.0.0") && compare_versions(version, "< 12.6.0.0")) || (compare_versions(version, ">= 12.6.0.0") && compare_versions(version, "<= 12.7.0.0")) AND status_code == 200

Run it with nuclei: nuclei -id CVE-2026-1281 -u <target>

The full check

id: CVE-2026-1281

info:
  name: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection
  author: rxerium
  severity: critical
  description: |
    Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system.
  impact: |
    Unauthenticated remote attackers can execute arbitrary code on the EPMM appliance, leading to full system compromise. This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.
  remediation: |
    Apply the Ivanti security patch for EPMM or upgrade to a version above 12.7.0.0. Restrict network access to the EPMM management interface.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1281
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
    - https://www.helpnetsecurity.com/2026/01/30/ivanti-epmm-cve-2026-1281-cve-2026-1340/
    - https://www.cisa.gov/news-events/alerts/2026/01/29/cisa-adds-one-known-exploited-vulnerability-catalog
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-1281
    epss-score: 0.98688
    epss-percentile: 0.99924
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 1
    vendor: ivanti
    product: endpoint-manager-mobile
    shodan-query: product:"Ivanti Endpoint Manager Mobile (EPMM)"
  tags: cve,cve2026,ivanti,epmm,code-injection,rce,unauth,kev,vkev,passive

http:
  - raw:
      - |
        GET /mics/login.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<title>Ivanti System Manager: Sign In")'
          - 'contains(body, "Ivanti. All rights reserved.")'
        condition: and

      - type: dsl
        dsl:
          - '(compare_versions(version, ">= 12.5.0.0") && compare_versions(version, "< 12.6.0.0")) || (compare_versions(version, ">= 12.6.0.0") && compare_versions(version, "<= 12.7.0.0"))'

      - type: dsl
        dsl:
          - 'status_code == 200'

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - '<div[^>]*class="[^"]*product-version[^"]*"[^>]*>\s*([0-9.]+)\s*</div>'

      - type: regex
        name: detected_version
        part: body
        group: 1
        regex:
          - '<div[^>]*class="[^"]*product-version[^"]*"[^>]*>\s*([0-9.]+)\s*</div>'

References

Use this check only on systems you are authorised to test. Where the data comes from