DaystoPatch

IvantiExploited incident

Ivanti EPMM unauthenticated code injection zero-days (January 2026)

CVE-2026-1281, CVE-2026-1340Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 29 Jan 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Ivanti blog RSS feed, item 'January 2026 EPMM Security Update'CuratedQuote verified

    Thu, 29 Jan 2026 19:05:22 Z

    pubDate of the 'January 2026 EPMM Security Update' item. Ivanti's own disclosure (stating customers had already been exploited) is the earliest public signal found. The feed is a rolling list; this item will eventually drop off it.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    CISA KEV (CVE-2026-1281)ClaimedQuote verified29 Jan 2026

    Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

    Added to CISA's KEV catalog on 2026-01-29.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti blog: January 2026 EPMM Security UpdateCuratedQuote verified29 Jan 2026

    At the time of disclosure, we are aware of a very limited number of customers whose solution has been exploited.

    Page shows 'Last updated: January 29, 2026'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:aeff8184bc210732…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti blog postClaimedQuote verified29 Jan 2026, 19:05 UTC

    January 2026 EPMM Security Update

    The vendor's own disclosure.

    Source
    Ivanti blog post vendor blog
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet29 Jan 2026, 21:21 UTC

    Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1281 & CVE-2026-1340)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-1281ClaimedQuote verified29 Jan 2026, 21:31 UTC

    A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8d0af2ae35bf4919…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet30 Jan 2026, 08:30 UTC

    cyberveille : https:// cyberveille.ch/posts/2026-01-3 0-ivanti-alerte-sur-deux-failles-critiques-epmm-exploitees-en-zero-day-cve-2026-1281-1340/ 🌐 source : https://www. bleepingcomputer.com/news/secu rity/ivanti-warns-of-two-epmm-flaws-exploited-in-zero-day-attacks/ # CVE_2026_1281 # CVE_2026_1340

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet2 Feb 2026, 06:44 UTC

    zero-days faster than teams can patch—we’ve seen three actively exploited CVEs in two weeks (CVE-2026-21509, CVE-2026-20805, CVE-2026-1281). The real insight: teams moving fastest aren’t patching first. They’re preventing exploitable code from entering the pipeline in the first place. SAST catches

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-1340)ClaimedQuote verified8 Apr 2026

    Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

    Added to CISA's KEV catalog on 2026-04-08.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Ivanti blog postClaimedQuote verified

    January 2026 EPMM Security Update

    Source
    Ivanti blog post vendor blog
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Ivanti blog RSS feed, item 'January 2026 EPMM Security Update'CuratedQuote verified29 Jan 2026, 19:05 UTC

    Thu, 29 Jan 2026 19:05:22 Z

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cb2b41e6a67111c7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2026-1281 (CNA: Ivanti)CuratedQuote verified29 Jan 2026, 21:31 UTC

    "datePublished":"2026-01-29T21:31:17.041Z"

    CVE-2026-1340's record followed at 21:33:11Z.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8d0af2ae35bf4919…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Ivanti blog: January 2026 EPMM Security UpdateCuratedQuote verified

    We urge all customers using the on-prem EPMM product to promptly install the Security Update.

    The 'Security Update' was an interim RPM script that must be reapplied after any version upgrade (Help Net Security, 2026-01-30, quoting Ivanti).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:aeff8184bc210732…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Help Net Security (quoting Ivanti)CuratedQuote verified

    All Ivanti customers with on-prem EPMM installations should install the provided patch (a RPM script) quickly, as it doesn’t require any downtime or negatively affect any feature.

    Article dated January 30, 2026, describing patches released with the 2026-01-29 advisory for the supported 12.5.x, 12.6.x and 12.7.x lines. These were interim RPM fixes; Ivanti said 'The permanent fix for this vulnerability will be included in the next product release: 12.8.0.0' (planned for later in Q1 2026). The 12.8.0.0 release date was not evidenced.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5eb4f7618a2532b9…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Ivanti EPMM mobile device servers hit by two zero-days; interim patch Jan 29

Attackers exploited two Ivanti EPMM flaws that allow takeover without a login, and Ivanti shipped interim RPM patches when it disclosed them on 29 January 2026.

In plain words

Ivanti's mobile device management server (EPMM) had two critical flaws that attackers were using to take over servers before a fix existed. Ivanti released a temporary patch on 29 January 2026 and a permanent fix in a later version. If we run EPMM ourselves, we need it on a fixed version, we need to confirm the temporary patch was not lost during upgrades, and we should check for signs of compromise.

What happened and who is affected

What happened

On 29 January 2026 Ivanti disclosed CVE-2026-1281 and CVE-2026-1340, two code injection flaws in on-premises Endpoint Manager Mobile (EPMM) that let an unauthenticated attacker run code on the server, and said a very limited number of customers had already been exploited. Ivanti released interim RPM script patches the same day and said the permanent fix would come in EPMM 12.8.0.0. Further exploitation was reported in the following months, and CISA added CVE-2026-1340 to its catalog on 8 April 2026.

Who is affected

On-premises Ivanti EPMM 12.5.x, 12.6.x and 12.7.x without the January 2026 RPM patch (or a release that includes the fix). Ivanti Neurons for MDM, Ivanti EPM and Ivanti Sentry are not affected.

CVE-2026-1281, CVE-2026-1340. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/ivanti-cve-2026-1281/

Affected products

  • Ivanti Endpoint Manager Mobile (EPMM, on-premises)
How we built this timeline

One advisory covers both CVEs (identical descriptions, CVSS 9.8 each); KEV added CVE-2026-1281 on 29 Jan 2026 and CVE-2026-1340 on 8 Apr 2026, so kev_added is the earlier date.

Help Net Security (8 May 2026) states both 'were also exploited as zero-day vulnerabilities'. The fixes at disclosure were interim RPM scripts, not new releases; counting them as First fix/Fixed for all versions is a judgment call a reviewer may revisit if only the permanent 12.8.0.0 release should count (its release date was not found).

The Ivanti advisory page is JavaScript-only; vendor statements are cited from Ivanti's blog, its RSS feed and the CVE records.

Related

Ivanti report card