CVE-2026-1340

Ivanti EPMM allows unauthenticated remote code execution via code injection, enabling attackers to compromise endpoint management systems without credentials.

This unauthenticated RCE vulnerability in Ivanti Endpoint Manager Mobile allows attackers to execute arbitrary code on managed endpoints without authentication, posing a severe risk to DIB organizations relying on endpoint management for security posture and compliance. The vulnerability is actively exploited in the wild and linked to ransomware campaigns, making it a critical priority for patching and network segmentation to prevent lateral movement.

Shame score — An unauthenticated RCE vulnerability in a widely deployed endpoint management product that is actively exploited in the wild represents a severe, avoidable security failure.