$ cve CVE-2026-1281 JSON

CVE-2026-1281 KEV

9.8

CRITICAL · CVSS 3.1 · EPSS 98.7% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2026-02-01.

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	98.69% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-94
On CISA KEV	yes — remediate by 2026-02-01
Public exploit	none known
Published	2026-01-29
Last modified	2026-06-17

Name	Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Added	2026-01-29
Due	2026-02-01
Vendor / product	Ivanti / Endpoint Manager Mobile (EPMM)
Ransomware use	none reported

Vendor	Product
ivanti	endpoint manager mobile