CVE-2026-1340
CRITICAL KEVIvanti Endpoint Manager Mobile - Code Injection
Title source: llmExploitation Summary
CVE-2026-1340 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 8, 2026.
EIP tracks 3 public exploits from researchers including MehdiLeDeaut, watchTowr, sfewer-r7, including a Metasploit module exploits/linux/http/ivanti_epmm_rce.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2026-1281/1340, targeting Ivanti EPMM. It includes multiple payloads for remote command execution, reverse shells, webshells, persistence mechanisms, and data exfiltration, demonstrating a clear understanding of the vulnerability.
Description
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Exploits (3)
This repository contains functional exploit code for CVE-2026-1281/1340, targeting Ivanti EPMM. It includes multiple payloads for remote command execution, reverse shells, webshells, persistence mechanisms, and data exfiltration, demonstrating a clear understanding of the vulnerability.
This repository contains a functional exploit PoC for CVE-2026-1340, demonstrating a pre-auth RCE vulnerability in Ivanti EPMM via Bash arithmetic expansion behavior. The exploit leverages command substitution in array indices to achieve remote code execution.
This Metasploit module exploits an OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) to achieve unauthenticated remote code execution with root privileges. It uses a crafted HTTP request to inject commands via the 'h' parameter in the URI.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H