Overview
Two critical code‑injection vulnerabilities (CVSS 9.8) affect Ivanti Endpoint Manager Mobile (EPMM). They allow unauthenticated remote code execution via the In‑House Application Distribution and Android File Transfer Configuration features.
Impact
Exploitation can lead to full device compromise, exposing administrator/user names, email addresses, phone numbers, IP addresses, installed apps, IMEI, MAC, and GPS location data. Attackers may also modify device configurations through the EPMM API or web console.
Mitigation
Ivanti provides RPM scripts that can be applied without downtime or functional impact. Apply them immediately, and upgrade to EPMM 12.8.0.0 (expected Q1 2026) for a permanent fix.
- Download the official RPM patches from Ivanti’s security advisory.
- Run the scripts on each affected appliance; no service interruption is required.
- Plan an upgrade to version 12.8.0.0 as soon as it is released.
Detection Guidance
Ivanti supplies a regular expression to identify exploitation attempts in Apache access logs (/var/log/httpd/https-access_log):
^(?!127\.0\.0\.1:\d+ .*$).*?\/mifs\/c\/(aft|app)store\/fob\/.*?404
This pattern captures external requests (excluding localhost) to vulnerable endpoints that return a 404 response.
Log Monitoring Recommendations
- Search the access log with the provided regex on a regular basis.
- If possible, review off‑device or centralized logs, as attackers may delete or alter local logs after compromise.
- Correlate findings with Sentry logs for additional context.
Recovery Options
Do not attempt in‑place cleaning. Instead:
- Restore the EPMM appliance from a known‑good backup taken before the suspected exploitation.
- Or rebuild the appliance and migrate data to a fresh system.
CISA KEV Status and Compliance
CVE‑2026‑1281 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Federal civilian agencies must apply vendor mitigations or discontinue use by 1 February 2026 per Binding Operational Directive 22‑01.
Recommendations for Administrators
- Apply the RPM patches immediately.
- Upgrade to EPMM 12.8.0.0 as soon as it is available.
- Implement continuous log monitoring using the supplied regex.
- Maintain regular, offline backups and test restore procedures.
- Review and harden API and web‑console authentication settings.