Ivanti EPMM - Critical Flaw Added to CISA's Exploited Catalog

The Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability, identified as CVE-2026-1340, has a CVSS score of 9.8, indicating its severity. It allows attackers to execute code remotely without authentication, making it a significant threat.

What's at Risk

The flaw affects multiple versions of Ivanti EPMM, including:

• 12.5.0.0 and prior
• 12.6.0.0 and prior
• 12.7.0.0 and prior
• 12.5.1.0 and prior
• 12.6.1.0 and prior

With the potential for unauthenticated remote code execution, organizations using these versions are at high risk of exploitation.

Patch Status

Ivanti has acknowledged that there have been limited reports of exploitation in the wild. They urge all customers to apply the patch immediately. A new RPM detection tool has been released to help users identify potential compromises by scanning for known indicators of exploitation.

Immediate Actions

Organizations using Ivanti EPMM should take the following steps:

1. Apply the latest patches as soon as possible.
2. Run the RPM detection tool to check for any signs of compromise.
3. Monitor for suspicious activity and review logs with your security team.

Conclusion

CISA has mandated that federal agencies must address this vulnerability by April 11, 2026. It is also recommended that private organizations review the KEV catalog and take necessary actions to protect their infrastructure. Ignoring this vulnerability could lead to severe security breaches, making immediate action crucial.