CVE-2026-1340 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-01-29

Added to CISA KEV: 2026-04-08 69 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update to Ivanti EPMM version 12.x.0.x RPM or 12.x.1.x RPM which are unaffected
Monitor HTTP request logs for suspicious patterns and code injection attempts
Scan for web shells and backdoors that may have been deployed through exploitation
Consider temporarily isolating EPMM servers from internet access until patching is complete
HIGH PRIORITY patching - exploit code likely available due to active exploitation

Ivanti EPMM RCE Zero-Days (CVE-2026-1281, 1340) | Horizon3.ai
CVE-2026-1281 and CVE-2026-1340 are actively exploited RCE flaws in Ivanti EPMM. Verify exposure and confirm remediation with NodeZero Rapid Response.Technical Details. The vulnerabilities stem from improper handling and validation of HTTP requests within Ivanti Endpoint Manager Mobile. Specially crafted requests can trigger remote code execution without authentication. Attack characteristics
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-1340
Ivanti EPMM RCE: CVE-2026-1281 & CVE-2026-1340 - Indusface
CVE-2026-1281 and CVE-2026-1340 are critical vulnerabilities that enable unauthenticated remote code execution over the network. Any exposed ...
CISA Adds One Known Exploited Vulnerability to Catalog | CISA
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
Critical Vulnerabilities in Ivanti EPMM Exploited
We discuss widespread exploitation of Ivanti EPMM zero-day vulns CVE-2026-1281 and CVE-2026-1340. Attackers are deploying web shells and backdoors.

🔴 CVE-2026-1340