{"id":"CVE-2026-1281","title":"A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.","summary":"A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-94"],"vendor":"Ivanti","product":"Endpoint Manager Mobile","affected":["endpoint_manager_mobile (all versions)"],"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-01-30T04:55:43.957910Z"},"exploited":true,"exploitAvailable":true,"published":"2026-01-29","updated":"2026-10-07","sourceUpdated":"2026-10-07T18:00:12.330Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-1281","references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340"}],"tags":["cve.org","in-the-wild","exploit-available","kev"],"epss":0.98688,"epssPercentile":0.99924,"kev":true,"kevDateAdded":"2026-01-29","kevDueDate":"2026-02-01","kevRansomware":false,"exploits":{"github":2,"githubRepos":["https://github.com/MehdiLeDeaut/CVE-2026-1281-Ivanti-EPMM-RCE","https://github.com/YunfeiGE18/CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE"],"metasploit":["exploit/linux/http/ivanti_epmm_rce"],"nuclei":["CVE-2026-1281"],"checkedAt":"2026-10-07T18:42:55.499Z"},"zeroDay":true,"ingestedAt":"2026-10-07T18:42:20.911Z","slug":"CVE-2026-1281","body":"## Overview\n\nA code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.\n\n## Affected\n\n- `endpoint_manager_mobile (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"hadal","depthScore":99,"depthScoreParts":{"impact":53.9,"likelihood":19.7,"exploitation":25,"ransomware":0},"changes":[]}