CVE-2026-1281

This vulnerability is like leaving a “back door” in a building that doesn’t require a key: an outsider can contact the Ivanti service and trick it into running malicious code. If the service is reachable, attackers can take control of the system and cause damage, including installing malware or disrupting operations.

This matters if you use Ivanti Endpoint Manager Mobile and the mobile service is reachable from the network. The risk is highest when an attacker can reach the service over the network (for example, from the internet or an untrusted network path), because it does not require a login or user interaction.

This is actively being exploited in the real world and is listed in CISA KEV, so you should treat it as an immediate, high-priority incident risk. Because it is unauthenticated and network-reachable by default, waiting increases the chance attackers compromise your systems.

1. Confirm exposure

   • Identify whether you run Ivanti Endpoint Manager Mobile (including any “mobile service” component) in production, staging, or remote admin environments.
   • Verify network reachability: determine whether the service is exposed to the internet or any untrusted network. If you have firewalls/security groups, check whether inbound access exists from outside your trusted management network.

2. Confirm version and whether you are affected

   • Check your current Endpoint Manager Mobile version and deployment type (RPM-based installs per the vendor fix notes).
   • If your installed version falls under the vulnerable 12.x lines per your current branch, assume you are affected until you upgrade to a vendor-confirmed fixed release.

3. Upgrade to the fixed version (target remediation)

   • Upgrade Endpoint Manager Mobile RPMs to fixed releases as indicated by the vendor:
     • fixed in 12.x.1.x RPM
     • also fixed in 12.x.0.x RPM
   • Follow the vendor’s upgrade procedure for your specific 12.x branch, including any configuration steps after RPM updates.
   • Note: use the vendor advisory linked in their security advisory for the exact version number(s) appropriate to your current install.

4. If patching is delayed: mitigation now

   • Apply the mitigations per the vendor instructions from the Ivanti security advisory.
   • Immediately restrict network access to the mobile service so it is not reachable from the internet or other untrusted networks.
   • Disable or remove external exposure temporarily if your environment allows (and document the change).

5. Keep an eye out after changes

   • Review logs for unexpected request patterns to the mobile service, especially immediately before and during the compromise window.
   • Watch for signs of follow-on compromise (new unexpected processes/services, unknown outbound connections, configuration changes).

6. Timing

   • CISA KEV remediation due date: 2026-02-01.

Severity and status: This vulnerability is critical (remote code execution) and is confirmed to be actively exploited in the wild; it is also listed in CISA KEV.

Weakness and mechanism: CWE-94 indicates code injection. The mechanism is an injection flaw triggered by specially crafted network requests that causes the Ivanti Endpoint Manager Mobile service to execute attacker-controlled code.

Attack vector and prerequisites: Network-based reachability with no authentication and no user interaction required. The only practical prerequisite is that the vulnerable service is reachable over the network.

Exploitation maturity: KEV and news reporting confirm in-the-wild exploitation; the traffic is not just theoretical.

KEV meaning here: CISA KEV indicates the vulnerability met criteria for known exploitation and requires action by organizations as part of CISA’s guidance.

Additional signals: Qilin is mentioned in PULSE as the likely actor associated with exploitation reporting. (EPSS is a prediction; per findings guidance, KEV/news confirmation should be treated as the driving risk signal.)