Code Injection in Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1340) — Unauthenticated Remote Code Execution; the Mobile-Device-Management Platform as Target

1What code injection is

Code injection (CWE-94) is a flaw in which an attacker slips code (commands) into input that should be treated purely as data, and the system executes it. Without adequate validation and separation of input, an attacker can run the injected code on the server — effectively taking over the machine.

What makes this severe is that it is said to be possible on Ivanti EPMM without authentication (no login), as the vector's PR:N (no privilege required) and UI:N (no user interaction) confirm.

2The weight of an MDM platform

That the target is an MDM (mobile-device-management) platform is decisive for the weight of this flaw. EPMM functions as the distribution source that pushes settings, certificates, and apps to the many smartphones and tablets an organization deploys.

Seize that source without authentication and the impact is not confined to one device but can propagate across the entire managed fleet — a single breach spreading to the whole company's mobile estate. EPMM is also often placed facing the internet so that devices outside the office can check in at any time, making it easy for attackers to reach.

3Why Ivanti products keep being targeted

Ivanti products (EPMM, Connect Secure, and others) have been KEV regulars in recent years, emblematic of how boundary and management products are targeted again and again. CISA set the remediation window to just three days after the addition and additionally asks organizations to "check for signs of compromise" — i.e., respond on the assumption that exploitation is already underway.

The response is prompt updating per Ivanti's guidance, together with checking whether compromise has occurred.

4Taking the source of distribution

That the subject is an MDM platform is what settles the weight here. EPMM stands on the side that distributes to devices, so control of it spreads differently.

1. 1Take the distribution sourceEPMM is what pushes configuration, certificates and applications out
2. 2It reaches the managed fleetNot one device taken but the whole managed fleet exposed
3. 3It is easy to reachOften placed facing the internet so that off-site devices can check in
4. 4One breach reaches the whole organisationReachability and distribution privilege coincide

That it can succeed unauthenticated is severe in itself, and the vector's PR:N and UI:N confirm it. CISA set the deadline three days after listing and asked in addition that organisations check for signs of compromise — the response is framed on the assumption that exploitation has already occurred.