Product of Ivanti

Endpoint Manager Mobile (EPMM)

As of , 7 Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 3 were added in 2026. Patch first: CVE-2026-1340.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-1340Code InjectionIvanti Endpoint Manager Mobile (EPMM)Patch this weekMetasploit module; EPSS 0.990.99
2CVE-2026-1281Code InjectionIvanti Endpoint Manager Mobile (EPMM)Patch this weekMetasploit module; EPSS 0.990.99
3CVE-2025-4427Authentication BypassIvanti Endpoint Manager Mobile (EPMM)Patch this weekMetasploit module; EPSS 0.990.99
4CVE-2025-4428Code InjectionIvanti Endpoint Manager Mobile (EPMM)Patch this weekMetasploit module; EPSS 0.870.87
5CVE-2023-35081Path TraversalIvanti Endpoint Manager Mobile (EPMM)Patch this weekEPSS 0.640.64
6CVE-2023-35078Endpoint Manager Mobile Authentication BypassIvanti Endpoint Manager Mobile (EPMM)Patch this weekRansomware use; EPSS 0.990.99
7CVE-2026-6973Improper Input ValidationIvanti Endpoint Manager Mobile (EPMM)Patch soon0.03

Added each year

1232023: 2220232024: nonenone20242025: 2220252026: 332026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20232
2024none
20252
20263

Used in ransomware

Changes CISA made to these entries

  1. CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM)Removed from CISA's list.
  2. CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM)Restored to CISA's list.
  3. CVE-2025-4428 Ivanti Endpoint Manager Mobile (EPMM)Edited: description.

Every change we recorded