Ivanti EPMM CVE-2026-1281 and CVE-2026-1340: unauthenticated code injection, mass exploitation and sleeper web shells

What happened

On 29 January 2026, Ivanti disclosed two code-injection flaws in EPMM, formerly MobileIron Core. Both are rated CVSS 9.8 and let an unauthenticated attacker run code on the appliance (CVE record; CVE record). They were already being exploited. Ivanti said “a very limited number of customers” had been hit at disclosure (The Register).

The bugs sit in the In-House Application Distribution and Android File Transfer Configuration features. Requests to URLs under /mifs/c/appstore/ and /mifs/c/aftstore/ are handed to the bash scripts /mi/bin/map-appstore-url and /mi/bin/map-aft-store-url. A value in the request is evaluated as a bash expression, so a command substitution inside it runs on the server (Deutsche Telekom Security). watchTowr published an analysis and proof of concept on 30 January (Rapid7).

Exploitation then spread. Unit 42 “observed widespread and mostly automated exploitation attempts” and counted over 4,400 EPMM instances in its telemetry (Unit 42). Reported victims include the Dutch Data Protection Authority, the Dutch Council for the Judiciary, the European Commission’s mobile device management platform and Finland’s government ICT centre Valtori (Help Net Security). Observed activity included (Unit 42; Deutsche Telekom Security):

• sleep commands and DNS callbacks to test whether a host is vulnerable.
• JSP web shells at /mi/tomcat/webapps/mifs/401.jsp, 403.jsp and 1.jsp.
• Reverse shells over TCP 443, a second-stage script (/slt), cryptominers and the Nezha monitoring agent.
• Database dumps of EPMM tables holding users, LDAP settings and devices, and archives of /mi/files/system.

Sleeper shells. On 9 February, Defused Cyber reported a dormant in-memory Java class loader planted at /mifs/403.jsp. It does nothing until it receives a trigger parameter. GreyNoise assessed that an initial access broker was preparing hosts for others to use later (Help Net Security).

CISA added CVE-2026-1281 to its KEV catalog on 29 January 2026, with a deadline of 1 February. CVE-2026-1340 followed on 8 April, with a deadline of 11 April (CISA KEV).

Am I affected?

Affected versions are 12.5.1.0 and earlier, 12.6.1.0 and earlier, and 12.7.0.0 and earlier (CERT-EU). Ivanti Neurons for MDM, Ivanti Endpoint Manager (EPM) and other Ivanti cloud products are not affected (The Register). An appliance that was reachable from the internet before you applied the RPM should be checked for compromise, whatever its patch state now.

Check the access logs. Search the appliance’s Apache access logs for requests to the two vulnerable paths. Legitimate requests return HTTP 200; exploitation attempts often return 404. Also look for any other GET requests whose parameters contain bash commands (The Register).

# Run against exported Apache access logs from the appliance
grep -E '/mifs/c/(app|aft)store/' access_log* | grep -v '" 200 '
grep -E '/mifs/(401|403|1)\.jsp' access_log*

Check for web shells. Requests to error pages such as 401.jsp or 403.jsp that use POST or carry parameters are “highly suspicious” (The Register). On the appliance:

grep -l "class U extends ClassLoader" /mi/tomcat/webapps/mifs/*.jsp
ls -la /mi/tomcat/webapps/mifs/ /mi/tomcat/webapps/mifs/css/

Unit 42 lists css/test.css, css/poc.css and css/cssaaa.css as test files dropped by attackers (Unit 42). Germany’s BSI also reported a web shell at /var/www/ext/html/favicon.png and files with one- or two-digit names in /, /tmp and /var/tmp (Deutsche Telekom Security). Also look for unexpected WAR or JAR files.

Check outbound traffic. EPMM rarely makes outbound connections, so any unexpected outbound traffic in firewall logs deserves a look (The Register). Unit 42 and Deutsche Telekom publish IP and domain indicators, and Telekom keeps a full list as a CSV on GitHub. Ivanti and the Dutch NCSC also released a detection script (Help Net Security).

What to do now

1. Apply the RPM for your version. RPM 12.x.0.x covers 12.5.0.x, 12.6.0.x and 12.7.0.x. RPM 12.x.1.x covers 12.5.1.0 and 12.6.1.0 (Rapid7). No downtime is needed (Unit 42). Use the latest RPM build listed in Ivanti’s advisory; Ivanti issued further security updates on 4 February (Help Net Security).
2. Reapply the RPM after every version upgrade until you are on a release with the permanent fix. CERT-EU says the RPM “will not survive a version upgrade” and that the permanent fix is in EPMM 12.8.0.0, planned for Q1 2026 (CERT-EU). Confirm in Ivanti’s advisory that the release you move to includes it.
3. Restart the application servers after patching to clear in-memory implants such as the 403.jsp class loader (Help Net Security).
4. If you find signs of compromise, do not clean in place. Ivanti advises restoring from a backup taken before exploitation and then upgrading, or building a replacement appliance and migrating the data to it (The Register). The Dutch NCSC advises all EPMM users to assume compromise and investigate (Help Net Security).
5. Rotate what the appliance held if it was compromised. Attackers dumped the mifs database tables for users, LDAP users and LDAP server configuration (Deutsche Telekom Security), so change the LDAP bind account and any service credentials stored in EPMM, and review the managed-device data that may have been exposed.
6. Look beyond the appliance. Ivanti warns of lateral movement from EPMM (The Register). Check systems EPMM can reach, starting with the directory it binds to.

Sources

• CERT-EU Security Advisory 2026-001: Ivanti EPMM
• CVE record: CVE-2026-1281
• CVE record: CVE-2026-1340
• The Register: Ivanti coughs up exploited EPMM zero-days
• Rapid7: critical Ivanti EPMM zero-day exploited in the wild
• Unit 42: Ivanti CVE-2026-1281 and CVE-2026-1340
• Help Net Security: Ivanti EPMM sleeper web shell
• Deutsche Telekom Security: Ivanti CVE-2026-1281 exploitation
• CISA Known Exploited Vulnerabilities catalog