CVE-2026-1281
CRITICAL KEVIvanti Endpoint Manager Mobile (EPMM) unauthenticated RCE
Title source: metasploitExploitation Summary
CVE-2026-1281 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 29, 2026. EIP tracks 3 public exploits from researchers including XiaomingX, MehdiLeDeaut, YunfeiGE18.
AI-analyzed exploit summary This repository contains a Python script that performs safe, non-exploitative checks for CVE-2026-1281 in Ivanti EPMM by sending HEAD and GET requests to known affected paths and analyzing response times and status codes. It does not contain exploit code but helps identify potentially vulnerable instances.
Description
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Exploits (3)
This repository contains a Python script that performs safe, non-exploitative checks for CVE-2026-1281 in Ivanti EPMM by sending HEAD and GET requests to known affected paths and analyzing response times and status codes. It does not contain exploit code but helps identify potentially vulnerable instances.
This repository contains functional exploit code for CVE-2026-1281, targeting Ivanti EPMM. It includes multiple payloads for remote command execution, reverse shells, webshells, persistence mechanisms, and data exfiltration, demonstrating a clear understanding of the vulnerability.
This repository contains a functional Dockerized environment to reproduce CVE-2026-1281 and CVE-2026-1340, Ivanti EPMM pre-auth RCE vulnerabilities. It includes a vulnerable CGI script and test scripts to demonstrate command execution via Bash arithmetic expansion.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H