CVE-2026-1281

Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile

View on CVE.org
Published Jan 29, 2026 CVSS 3.1 · 9.8 Critical EPSS 98.7% KEV · Listed
Description
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Analysis

AI-generated

Technical impact

A code injection flaw in Ivanti Endpoint Manager Mobile allows attackers to execute arbitrary code without requiring authentication. The vulnerability is a classic code injection (CWE‑94) that can be leveraged to run malicious commands on the device or server hosting the application, potentially compromising confidentiality, integrity, and availability of managed endpoints.

Affected Systems

The affected product is Ivanti Endpoint Manager Mobile. The vulnerability manifests in multiple releases, including version 12.5.1.0 and all subsequent 12.6.x and 12.7.x releases such as 12.6.0.0, 12.6.1.0, and 12.7.0.0.

Risk and Exploitability

The CVSS v3.1 score of 9.8 indicates critical severity, and the EPSS score of 99% signals a high likelihood of exploitation. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, underscoring its real‑world impact. Attackers can exploit the flaw remotely, without prior authentication, to achieve arbitrary code execution on affected instances. Consequently, the risk is immediate and severe for organizations running the impacted versions.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Ivanti Endpoint Manager Mobile to a version that contains the fix for the code injection vulnerability (CWE‑94).
  • If an immediate upgrade is not feasible, temporarily disable any exposed interfaces or features that allow remote code execution until a patch is applied, thereby preventing code injection exploitation.
  • Employ network segmentation or firewall rules to restrict external traffic to the Endpoint Manager Mobile servers, minimizing the attack surface.
  • Continuously monitor system logs for anomalous activity indicative of exploitation attempts, and regularly check Ivanti’s security portal or vendor website for patches or advisories related to this CVE.

Generated by OpenCVE AI on September 21, 2026 at 08:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution via Code Injection in Ivanti Endpoint Manager Mobile
Type Values Removed Values Added
CPEs cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager_mobile:12.7.0.0:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Ivanti
Ivanti endpoint Manager Mobile
Vendors & Products Ivanti
Ivanti endpoint Manager Mobile
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

kev

{'dateAdded': '2026-01-29T00:00:00+00:00', 'dueDate': '2026-02-01T00:00:00+00:00'}
Earlier changes (8)
Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
ivanti
Published
Updated
Oct 7, 2026, 6:00 PM
Reserved
Jan 21, 2026, 3:38 AM

View source JSON

Updated
Jan 29, 2026, 9:59 PM

JSON

Status
Analyzed
Published
Jan 29, 2026, 10:15 PM
Modified
Jun 17, 2026, 10:15 AM

View source JSON

No data.

Updated
Sep 21, 2026, 8:45 AM

JSON