Notifications
Clear all
Topic starter
20/08/2026 5:28 pm
TL;DR: CVE-2026-1281 and CVE-2026-1340 are critical unauthenticated command injection flaws in Ivanti EPMM, with active exploitation used to install webshells, establish persistence, and pivot into internal environments, according to Expel. The incident shows how internet-facing management planes can become identity and device control choke points when patching, log preservation, and credential rotation lag behind exposure.
NHIMG editorial — based on content published by Expel: Ivanti EPMM zero-days and active exploitation guidance
By the numbers:
- CVE-2026-1281 and CVE-2026-1340 both carry a CVSS score of 9.8.
Questions worth separating out
Q: What breaks when an internet-facing mobile management platform is compromised?
A: The management plane stops being a control and becomes an attacker-operated trust anchor.
Q: Why do unauthenticated command injection flaws create such a large blast radius?
A: Because they bypass the authentication step entirely, the attacker starts with execution rather than access.
Q: How do security teams know whether a management-plane compromise has affected identity trust?
A: Look for changes to device policy, certificate trust, service account behaviour, and access decisions that no longer match the expected enrollment state.
Practitioner guidance
- Patch exposed EPMM instances immediately Apply the version-specific RPM updates without delay, and reapply them if the system is upgraded before version 12.8.0.0 so the fix is not lost during maintenance.
- Rebuild or restore compromised instances If compromise is confirmed, rebuild the instance or restore from a backup taken before the first indicator of compromise.
- Rotate every credential that touched the management plane Rotate service account passwords, local administrator passwords, and replace public certificates because those trust artefacts may have been exposed or altered during exploitation.
What's in the full analysis
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- Exact triage patterns for identifying exploitation in Apache logs, including the 404 request signature tied to the vulnerable endpoints.
- The specific remediation sequence for compromised appliances, including rebuild versus restore decision points.
- The full IoC handling guidance and credential rotation steps for service accounts, local admin accounts, and public certificates.
👉 Read Expel's analysis of Ivanti EPMM zero-days and active exploitation →
Ivanti EPMM zero-days: are your mobile management controls exposed?
Explore further
20/08/2026 6:16 pm
Unauthenticated management-plane access is a governance failure, not just a patching issue. When an internet-facing MDM platform can be turned into code execution without credentials, the real problem is that a control plane is reachable before identity validation even begins. That breaks the normal assumption that administrative compromise requires authenticated misuse. Practitioners should treat exposed management interfaces as privileged infrastructure, not ordinary applications.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37%, according to the same report.
A question worth separating out:
Q: Who is accountable when an exposed management system is used for initial access?
A: Accountability is shared across vulnerability management, platform operations, and identity governance because the failure spans patching, exposure control, and trust design. Frameworks such as NIST CSF and NIST SP 800-53 place that responsibility on governance, access control, and monitoring disciplines rather than on one team alone.
👉 Read our full editorial: Ivanti EPMM zero-days expose mobile management as a control gap
