Zero Day MonitorZDM

CVE-2026-1281: A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. — Zero Day Monitor

← Back to list

9.8

CVE-2026-1281KEVEXPLOITEDPATCHED

ivanti · endpoint_manager_mobile

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Affected Products

Vendor	Product	Versions
ivanti	endpoint_manager_mobile	<= 12.5.0.0, 12.6.0.0, 12.7.0.0, 12.5.1.0, 12.6.1.0

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340(Patch, Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281(US Government Resource)

Related News (1 articles)

Tier B

CCCS Canada3h ago

Ivanti security advisory (AV26-068) – Update 2

→ No new info (linked only)

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV✅ Yes

Actively exploited✅ Yes

Patch available

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340

CWECWE-94

PublishedJan 29, 2026

Last enriched3h agov2

Trending Score98

Source articles1

Independent1

Info Completeness11/14