Vulnerability threat dossier

CVE-2026-1340

ivantiendpoint manager mobile

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

VTP deterministic threat70.7of 100 · CVSS excluded

VTP analyst assessment

Ivanti Endpoint Manager Mobile code injection

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateCANDIDATE CREATED
AI priorityCRITICAL
AI confidence97%
Public exploitation · VTP factKEV

Assessment

CVE-2026-1340 is an unauthenticated code-injection flaw in Ivanti Endpoint Manager Mobile that enables remote code execution. CISA KEV and ENISA EU KEV list known exploitation. ProjectDiscovery also provides public template coverage.

Why it matters

  • An attacker who can reach a vulnerable EPMM service could execute code without authentication.
  • EPMM manages mobile endpoints, so compromise could expose a management service and its connected environment.

Evidence

2 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 1 independent evidence group.

Uncertainties

The supplied reports do not identify targets, affected deployments, or a specific exploitation method.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use Ivanti EPMM, apply Ivanti's fix on vulnerable instances as a priority.

AI baseline history (4)
  1. BASELINE ASSESSED
    Ivanti Endpoint Manager Mobile code injectiongpt-5.6-terra · low
  2. BASELINE ASSESSED
    Ivanti EPMM code injectiongpt-5.6-terra · low
  3. BASELINE ASSESSED
    Ivanti EPMM unauthenticated code injectiongpt-5.6-sol · high
  4. BASELINE ASSESSED
    Ivanti EPMM unauthenticated code injectiongpt-5.6-sol · high
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityPOCReliability not implied
EPSS0.99100th percentile · prediction
Evidence confidence95%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    A proof of concept is reported; functional reliability is not established.

  3. 03

    EPSS is 0.99; this is predictive context, not exploitation evidence.

  4. 04

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

EXPLOIT TEMPLATE AVAILABLEPublic exploit-oriented template available
KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

2publications detected
2underlying evidence chains

1 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOIT TEMPLATE AVAILABLEPUBLIC EXPLOIT TEMPLATE
90%claim confidence
PRIMARYcorpus:NUCLEI:e092c7ea3b36b68aa9b1b6d50b4d48880821a80dACTIVE
Evidence
Source claimACTIVE EXPLOITATIONENISA EU KEV LISTED
95%claim confidence
INDEPENDENTcatalog:enisa-eu-kev:CVE-2026-1340ACTIVE
Evidence
04

Event history

Threat timeline

  1. 09:2518 Sept
    EXPLOIT TEMPLATE AVAILABLE

    Public exploit-oriented template available

    ProjectDiscovery nuclei-templates published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.

  2. 00:0008 Apr
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

  3. 00:0029 Jan
    ACTIVE EXPLOITATION

    ENISA EU KEV entry added

    ENISA EU KEV reports known exploitation. VTP imported this historical entry as source baseline. This is public intelligence, not a VTP sensor observation.

05

Original publications

Source record

Exploit tooling coverage changed for 6 CVEs

ProjectDiscovery nuclei-templates recorded exploit-tooling coverage changes for 6 CVEs in this pinned revision. 6 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.

CVE-2018-7600CVE-2026-1340CVE-2026-69085CVE-2026-82456CVE-2026-86218CVE-2026-9103
Separate evidence group
Original

ENISA EU KEV catalog membership for CVE-2026-1340

ENISA EU KEV lists this vulnerability as known to be exploited. This is public intelligence, not a VTP sensor observation.

CVE-2026-1340
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score70.7vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction19.74 / 20
Exploit availability7.5 / 15
Source independence7.5 / 15
Intelligence recency6 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-94
CPE records
1
Deterministic history records
20
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.