CVE-2026-1340
IV
Ivanti Endpoint Manager Mobile (EPMM)
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
What it is
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0S-5.noarch.rpm
- support.mobileiron.com/mi/vsp/AB1786671/ivanti-security-update-1761642-1.1.0L-5.noarch.rpm
- nvd.nist.gov/vuln/detail/CVE-2026-1340
Description and required action as published by CISA. Full record at NVD.
Other Ivanti entries on the list
- Connect Secure Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability CVE-2026-118527 · Oct 30, 2026
- Connect Secure Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-111357 · Oct 30, 2026
- Connect Secure Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability CVE-2026-104935 · Oct 13, 2026
- Sentry Ivanti Sentry OS Command Injection Vulnerability CVE-2026-10520 · Jun 11, 2026
- Endpoint Manager Mobile (EPMM) Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability CVE-2026-6973 · May 7, 2026
- Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability CVE-2026-1603 · Mar 9, 2026