criticalclosedpatched
Ivanti EPMM code injection CVE-2026-1340 exploited
› Ivanti Endpoint Manager Mobile (EPMM)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Jan 29, 2026
- closed
- Apr 30, 2026
- CVEs
- 1
- sources
- 2
## summary
Ivanti Endpoint Manager Mobile (EPMM) CVE-2026-1340 — unauthenticated RCE via code injection — was exploited in limited attacks disclosed late January 2026. CISA later ordered federal agencies to patch within days in April when adding/prioritizing the KEV entry.
severity: Critical; exploited in the wild / CISA KEV
## cve ids[1]
## affected
- See Ivanti Jan 29 2026 advisory
## fixed in
- Ivanti patched releases per January 2026 advisory
## advisories[2]
## notes & caveats
Verify primary vendor advisory for exact fixed versions; facts taken from public sources listed in links.
