CVE-2026-1340
Published: 29 January 2026
Summary
CVE-2026-1340 is a critical-severity Code Injection (CWE-94) vulnerability in Ivanti Endpoint Manager Mobile. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and correction of software flaws like CVE-2026-1340 via patching to prevent unauthenticated remote code execution.
Enforces validation of information inputs to directly counter code injection vulnerabilities such as CVE-2026-1340 at network entry points.
Requires vulnerability scanning to identify systems affected by CVE-2026-1340, enabling prioritized remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-1340 enables unauthenticated remote code execution via code injection in a public-facing Ivanti EPMM server, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Deeper analysisAI
CVE-2026-1340 is a code injection vulnerability (CWE-94) affecting Ivanti Endpoint Manager Mobile (EPMM). Published on 2026-01-29, it enables unauthenticated remote code execution on vulnerable systems. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high impact across confidentiality, integrity, and availability.
Any network-accessible attacker can exploit CVE-2026-1340 without authentication, privileges, or user interaction, and with low attack complexity. Successful exploitation allows remote code execution, potentially compromising the EPMM server and enabling full control over the affected endpoint management infrastructure.
Ivanti's security advisory (covering CVE-2026-1281 and CVE-2026-1340) provides details on the issue for EPMM. The vulnerability is also listed in CISA's Known Exploited Vulnerabilities Catalog, urging federal agencies to patch promptly. Practitioners should review these advisories for available patches and mitigation guidance.
Its inclusion in CISA's KEV catalog indicates real-world exploitation is occurring.
Details
- CWE(s)
- KEV Date Added
- 08 April 2026