CVE Tools
Track your stack

Someone Knows Bash Far Too Well, And We Love It (Ivanti EPMM Pre-Auth RCEs CVE-2026-1281 & CVE-2026-1340)

watchTowr LabsBy Piotr Bazydlo (@chudyPB)8 min read

Reported exploitedIvanti Endpoint Manager Mobile (EPMM)
Read at watchTowr Labs

Below is the opening; the full story is at watchTowr Labs.

From watchTowr Labs

When Ivanti removed the embargoes from CVE-2026-1281 and CVE-2026-1340 - actively exploited pre-auth Remote Command Execution vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) solution - we sighed with relief.

Clearly, the universe had decided to continue mocking Secure-By-Design signers right on schedule - every January.…

Continue at watchTowr Labs
  1. Dark ReadingMax-Severity Ivanti Flaw Exploited 24 Hours After DisclosureCVE-2026-1340
  2. Daily CyberSecurity (securityonline.info)Check Point VPN Vulnerability Exploited in the Wild with Ransomware LinksCVE-2026-1281
  3. Check Point Research13th April – Threat Intelligence ReportCVE-2026-1340

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store