CISA Warns of Critical Ivanti EPMM CVE-2023-35082 Exploited in Attacks

Key Takeaways

• A critical vulnerability, CVE-2026-1340, in Ivanti Endpoint Manager Mobile (EPMM) is under active exploitation.
• The flaw allows unauthenticated remote code execution (RCE), giving attackers full control over affected servers.
• No authentication is required for exploitation, making it highly severe.
• CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog and mandated immediate patching for federal agencies, urging all organizations to follow suit.

CISA Issues Urgent Warning: Ivanti EPMM Flaw Actively Exploited for Remote Code Execution

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a severe alert concerning a critical security vulnerability within Ivanti Endpoint Manager Mobile (EPMM). This flaw, designated CVE-2026-1340, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, confirming its active exploitation by threat actors in real-world cyberattacks.

The vulnerability is a code injection flaw, indicating that the software fails to adequately validate or sanitize input. This critical oversight enables remote attackers to achieve unauthenticated remote code execution (RCE). Essentially, malicious actors can execute arbitrary commands on a vulnerable Ivanti EPMM server without needing any valid login credentials.

By crafting and sending specialized requests, attackers can compel the system to run their malicious code. This grants them profound administrative control over the compromised machine, providing avenues for data theft, malware deployment, or lateral movement across an organization’s network infrastructure.

High-Value Target: Mobile Device Management Systems

Mobile device management (MDM) solutions, such as Ivanti EPMM, represent particularly attractive targets for adversaries. These systems inherently possess elevated privileges over corporate smartphones and tablets. A successful compromise of an MDM server could allow attackers to manipulate security policies or distribute malicious configurations to thousands of employee devices simultaneously, posing a significant organizational risk.

While CISA has verified that CVE-2026-1340 is actively being exploited, specific details regarding the identities of the victims or the threat groups responsible remain undisclosed. It is currently unknown whether this vulnerability is being leveraged in ransomware campaigns. Nevertheless, the complete system access it provides makes it a highly desirable target for sophisticated adversaries, including advanced persistent threat (APT) groups and financially motivated cybercriminals.

CISA officially added this vulnerability to the KEV list on April 8, 2026, and has mandated an urgent response. Federal Civilian Executive Branch (FCEB) agencies are required to implement necessary security measures by April 11, 2026.

While this stringent three-day deadline falls under Binding Operational Directive (BOD) 22-01 for federal entities, CISA strongly advises all private-sector organizations to adopt the same aggressive timeline for patching and mitigation.

What You Should Do

• Apply Patches Immediately: Organizations using Ivanti EPMM must apply all available patches and mitigations as instructed by Ivanti.
• Review Cloud Deployments: For cloud-based deployments, verify adherence to relevant BOD 22-01 guidance for cloud services.
• Disconnect if Unpatchable: If immediate application of mitigations is not feasible, organizations must disconnect and discontinue the use of Ivanti EPMM until a secure fix can be implemented.
• Monitor for Exploitation: Actively monitor network traffic and system logs for any indicators of compromise related to CVE-2026-1340.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.