Exploited vulnerabilitiesBriefConfirmed by two or more outlets
Ivanti EPMM zero-days (CVE-2026-1281 / -1340)
Disclosed 29 Jan 2026. CVSS 9.8, unauthenticated code injection.
- Disclosed
What happened
- KEV: 29 Jan 2026 (-1281). Fixed: RPM hotfix first, then EPMM 12.8.0.0.
- Exploitation was “widespread and mostly automated” (Unit 42). Sleeper webshells.
Live scores
Live scores
CVE-2026-1281- EPSS
- 0.987
very likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2026-01-29
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-1340- EPSS
- 0.986
very likely to be attacked soon - VEDAS
- 0.984
strong exploit evidence - On CISA KEV
- Yes, since 2026-04-08
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://www.theregister.com/2026/01/30/ivanti_epmm_zero_days/
- https://www.helpnetsecurity.com/2026/02/11/ivanti-epmm-sleeper-webshell/
- https://github.security.telekom.com/2026/03/ivanti-CVE-2026-1281-exploitation.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.