This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti EPMM fixes 2 critical vulnerabilities

Ivanti Endpoint Manager Mobile (EPMM) has released a patch for 2 critical vulnerabilities, one of which is being actively exploited [1][2]. Available fixes: RPM_12.x.0.x [3]: - for versions 12.5.0.x, 12.6.0.x and 12.7.0.x - compatible with 12.3.0.x and 12.4.0.x RPM_12.x.1.x [4]: - for versions 12.5.1.0 and 12.6.1.0 The RPM patch must be re-applied after every update to a different version until the final fix is released in version 12.8.0.0 (Q1 2026). To apply it, the installation command must be prefixed with credentials for the support.mobileiron.com portal. For further steps and detailed information see [1].

Ivanti Endpoint Manager Mobile - RCE (CVE-2026-1281)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute code [1]. This vulnerability is already being actively exploited [2].

The vulnerability is present in product:

  • Ivanti Endpoint Manager Mobile; >=12.0.0.0, <=12.0.0.5; >=12.1.0.0, <=12.1.0.5; >=12.2.0.0, <=12.2.0.1; >=12.3.0.0, <=12.3.0.3; >=12.4.0.0, <=12.4.0.4; >=12.5.0.0, <=12.5.0.4; >=12.6.0.0, <=12.6.0.2; ==12.7.0.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 29. 1. 2026.

Ivanti Endpoint Manager Mobile - RCE (CVE-2026-1340)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute code [1].

The vulnerability is present in product:

  • Ivanti Endpoint Manager Mobile; ==12.5.1.0; ==12.6.1.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 29. 1. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 2. 2. 2026.

CESNET, z.s.p.o. Logo