CVE Explorer
CVE-2026-1281
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"affected","product":"Endpoint Manager Mobile","vendor":"Ivanti","versions":[{"status":"unaffected","version":"12.x.1.x RPM","versionType":"custom"},{"status":"unaffected","version":"12.x.0.x RPM","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:4cbebdff5159123cd11a0bab31f609f4f399804a5559a7bab03e446eb75a88e9 · sha256:9674cd06fb4287f1… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:4cbebdff5159123cd11a0bab31f609f4f399804a5559a7bab03e446eb75a88e9 · sha256:9674cd06fb4287f1… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:4cbebdff5159123cd11a0bab31f609f4f399804a5559a7bab03e446eb75a88e9 · sha256:9674cd06fb4287f1… · /containers/cna/problemTypes/0/descriptions/0
Known exploitation assertions
2 source assertions{"cwes":["CWE-94"],"dateAdded":"2026-01-29","dueDate":"2026-02-01","knownRansomwareCampaignUse":"Unknown","notes":"Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please: see: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340 ; https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-upda…
- cisa_kev_jsonknown_exploitedurn:baitaphish:normalized-source-record:v2:ddd83d882e3d6a89502cf1288a0d0960f6cf8d63512140eb39059903433b3fe8 · sha256:16acee8334e59e44… · /vulnerabilities/156Open source location →
{"cwes":["CWE-94"],"dateAdded":"2026-01-29","dueDate":"2026-02-01","knownRansomwareCampaignUse":"Unknown","notes":"Please adhere to Ivanti's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Ivanti products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as possible. For more information please: see: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340 ; https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-upda…
- cisa_kev_jsonknown_exploitedurn:baitaphish:normalized-source-record:v2:54a44b4039cd749bef01d8fac0a8ecc7bfe268d00103aaeef01b84a420a0cdf9 · sha256:635dff916c4092c0… · /vulnerabilities/159Open source location →
Source references
2 source assertions{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4cbebdff5159123cd11a0bab31f609f4f399804a5559a7bab03e446eb75a88e9 · sha256:9674cd06fb4287f1… · /containers/cna/references/0
{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1281"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:4cbebdff5159123cd11a0bab31f609f4f399804a5559a7bab03e446eb75a88e9 · sha256:9674cd06fb4287f1… · /containers/adp/0/references/0
Attribution and limitations
- CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.