Ivanti Endpoint Manager Mobile: Mehrere Schwachstellen ermöglichen Codeausführung
WID-SEC-2026-0255 · first 30.01.2026 · updated 09.04.2026 · CVSS 9,8
What it is about
Ivanti Endpoint Manager Mobile ist eine mobile Verwaltungssoftware zur Verwaltung von Richtlinien für mobile Geräte, Anwendungen und Inhalte. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager Mobile ausnutzen, um beliebigen Programmcode auszuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- Ivanti Endpoint Manager Mobile RPM <12.x.0.x
- Ivanti Endpoint Manager Mobile RPM <12.x.1.x
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Ivanti Endpoint Manager Mobile RPM 12.x.0.x
- Ivanti Endpoint Manager Mobile RPM 12.x.1.x
Is the vulnerability already being exploited?
- CVE-2026-1340: exploited in the wild according to CISA, in the catalogue since 08.04.2026.
- CVE-2026-1281: exploited in the wild according to CISA, in the catalogue since 29.01.2026.
Information and sources
- Original BSI advisory (WID)
- January 2026 EPMM Security Update vom 2026-01-29 www.ivanti.com
- Security Advisory Ivanti Endpoint Manager Mobile vom 2026-01-29 forums.ivanti.com
- CISA KEV CVE-2026-1340 vom 2026-04-08 www.cisa.gov
CVE: CVE-2026-1281, CVE-2026-1340
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.