Patch/Configuration Management

The attack exploited two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, in Ivanti Endpoint Manager Mobile (EPMM) software.

The vulnerability, CVE-2026-1731, is a pre-authentication remote code execution flaw that can be exploited through low-complexity attacks requiring no user interaction.

CVE-2026-23760 and CVE-2026-24423 could both lead to RCE and are under active exploitation.

The paper reveals that only 32% of vulnerabilities in the CISA KEV catalog are immediately exploitable for initial access, challenging the common misconception that it lists the most severe flaws.

The vulnerability, tracked as CVE-2025-67987, allows any user with a subscriber-level account or higher to inject commands into the database.

The study identified approximately 4.96 million IP addresses with publicly accessible .git directories.

Exploited Ivanti EPMM RCEs hit agencies, prompting emergency patching amid fears of global spread.