Which products and versions are affected by CVE-2026-1340?

Affected: Endpoint Manager Mobile (Ivanti). The full list is in the CVE brief.

Is CVE-2026-1340 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 29, 2026 and is known to be used in ransomware campaigns.

Is CVE-2026-1340 in the CISA KEV catalog?

Yes. It was added on Apr 8, 2026 with a federal remediation due date of Apr 11, 2026.

Is there a public exploit for CVE-2026-1340?

Public exploit code is available.

Is there a fix for CVE-2026-1340?

Fixed versions are available, including Endpoint Manager Mobile 12.7.0.0.

How urgently should CVE-2026-1340 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2026-1340

CriticalExploitedPublic exploit

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Published Feb 9, 2026 · Updated Apr 9, 2026

Key Facts

Patch immediately

CVE-2026-1340 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Endpoint Manager Mobile (Ivanti).
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 29, 2026 and is known to be used in ransomware campaigns. Public exploit code is available.
EPSS estimates a 99% probability of exploitation in the next 30 days.
Fixed versions are available, including Endpoint Manager Mobile 12.7.0.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

99%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-1340 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Apr 8, 2026	Apr 11, 2026	Not reported
Industry KEV feed	Feb 4, 2026	Apr 11, 2026	Known
CIRCL KEV	Jan 29, 2026	Apr 11, 2026	Not reported
ENISA EUVD	Jan 29, 2026	n/a	Not reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

2 affected entries in total

Product	Affected versions	Fixed in
Endpoint Manager MobileIvanti	See advisory	12.7.0.0

Patched Releases

Endpoint Manager Mobile

12.7.0.0

Timeline

Added to CIRCL KEV
Jan 29, 2026
Added to ENISA EUVD
Jan 29, 2026
Added to Industry KEV feed
Feb 4, 2026
Publicly disclosed
Feb 9, 2026
Added to CISA KEV
Apr 8, 2026
Last updated
Apr 9, 2026

Weakness Type

CWE-94 Improper Control of Generation of Code ('Code Injection')

References

11 more references in the full CVE brief

FAQ

Common Questions.

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Affected: Endpoint Manager Mobile (Ivanti). The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 29, 2026 and is known to be used in ransomware campaigns.
Yes. It was added on Apr 8, 2026 with a federal remediation due date of Apr 11, 2026.
Public exploit code is available.
Fixed versions are available, including Endpoint Manager Mobile 12.7.0.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2026-1340 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.