Ivanti disclosed and patched two (2) critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, both unauthenticated remote code execution (RCE) flaws with CVSS scores of 9.8 that were actively exploited prior to public disclosure. Affecting multiple EPMM 12.5.x–12.7.x releases, the vulnerabilities stem from code-injection issues in the In-House Application Distribution and Android File Transfer Configuration features and allow attackers to execute arbitrary code, access highly sensitive data stored on the appliance (including administrator and user credentials, device identifiers, network details, and potentially location data), and make configuration changes that could facilitate persistence or lateral movement. Ivanti released temporary RPM-based hotfixes that require no downtime but do not persist across version upgrades, with a permanent fix scheduled for EPMM 12.8.0.0 later in Q1 2026, while acknowledging a limited number of confirmed compromises and limited visibility into attacker TTPs. Detection guidance centers on identifying anomalous 404 responses to specific endpoints in Apache access logs, though Ivanti warned attackers may delete local logs post-compromise, recommending off-device log review where possible. Rather than attempting cleanup, Ivanti advises organizations to treat suspected compromises as full incidents, restore from known-good backups or rebuild appliances, reset credentials, and replace certificates, while also reviewing Ivanti Sentry systems for potential downstream impact. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)added CVE-2026-1281 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies remediate by no later than February 1, 2026. Independent research by watchTowr Labs confirmed the flaws are exploitable over HTTP via crafted GET requests abusing app store-related Bash scripts, reinforcing warnings that patching alone may be insufficient for internet-exposed EPMM instances. CTIX analysts urge any affected administrators to follow Ivanti’s guidance to investigate potential compromises.