What is the CVSS score of CVE-2026-1340?

CVE-2026-1340 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 50.9%.

Which versions of Ivanti are affected by CVE-2026-1340?

A critical unauthenticated remote code execution vulnerability in Ivanti Endpoint Manager Mobile (CVE-2026-1340, CVSS 9.8) poses an immediate threat to any organization using this platform.

Is there a public PoC exploit available for CVE-2026-1340?

Yes, a public proof-of-concept exploit is available for CVE-2026-1340. Prioritise patching immediately. EPSS: 50.9%.

How to fix or mitigate CVE-2026-1340?

Within 24 hours: Inventory all Ivanti Endpoint Manager Mobile instances, isolate affected systems from production networks if operationally feasible, and enable enhanced logging/monitoring. Within 7 days: Implement network segmentation to restrict access to management interfaces, deploy WAF rules to block exploitation attempts, and brief incident response teams on activation criteria. Within 30 days: Contact Ivanti for patch availability and deployment timeline; if patch is unavailable, evaluate replacement solutions or permanent network isolation of affected systems.

Ivanti CVE-2026-1340

CRITICAL

Code Injection (CWE-94)

2026-01-29 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Ivanti RCE Code Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 09, 2026 - 14:03 cisa

CISA KEV

CIRCL Exploitation Confirmed

Apr 09, 2026 - 14:03 circl

CIRCL KEV

PoC Detected

Apr 09, 2026 - 14:03 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 29, 2026 - 22:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Articles & Coverage 1

labs.watchtowr.com Ivanti EPMM Pre-Auth RCE via Bash Script Injection (CVE-2026-1281, CVE-2026-1340)

AnalysisAI

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that allows unauthenticated attackers to achieve remote code execution on the mobile device management server. Compromising the MDM server provides access to all managed mobile device configurations, policies, and potentially the ability to push malicious profiles to enrolled devices.

Technical ContextAI

A code injection vulnerability in Ivanti EPMM allows unauthenticated attackers to execute arbitrary code on the MDM server. EPMM (formerly MobileIron) manages enterprise mobile devices, enforcing security policies, distributing applications, and controlling device configurations. The server holds certificates, VPN configurations, and WiFi credentials for all managed devices.

RemediationAI

Apply the latest Ivanti EPMM security patch. Restrict EPMM management interface access. Monitor for unauthorized profile deployments to managed devices. Rotate device enrollment certificates and VPN credentials. Review MDM audit logs for suspicious administrative actions.