Ivanti EPMM zero-days exploited in targeted attacks
Two critical unauthenticated RCE vulnerabilities in Ivanti Endpoint Manager Mobile are being actively exploited, with attackers deploying webshells and reverse shells for persistence.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-1281 and CVE-2026-1340 as exploited in the wild.
CERT-FR issued an alert regarding CVE-2026-1281 and CVE-2026-1340, two critical vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.x through 12.7.0.x. Ivanti confirmed these flaws allow unauthenticated attackers to achieve remote code execution and are being actively exploited in targeted attacks as of the January 29, 2026 advisory. A public proof-of-concept became available on February 2, 2026, increasing the risk of broader exploitation.
Ivanti has identified two known persistence mechanisms used by attackers: deployment of malicious webshells (via modified HTTP error pages such as 401.jsp or introduced WAR/JAR files) and reverse shell command prompts. Defenders are advised to inspect Apache access logs (/var/log/httpd/https-access_log) for suspicious POST requests to error pages or long-duration outbound connections indicative of reverse shell activity. Ivanti released RPM-based detection scripts on February 6, 2026, though these patches are described as temporary until version 12.8.0.0 is released.
Organizations with compromised EPMM instances are urged to isolate affected devices (including associated Sentry appliances) from all networks, restore from clean backups or rebuild the system, and reset all local, LDAP, KDC, and service account credentials, as well as revoke and replace public certificates. Given the unauthenticated RCE nature, active exploitation, and public PoC availability, this represents a significant edge-device compromise risk consistent with CERT-FR's network perimeter compromise guidance.
Mentioned in this report
Detection guidance
Suspicious POST Request to JSP Error Page on Ivanti EPMM
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects POST requests to JSP error pages (e.g. 401.jsp) on Ivanti EPMM/Tomcat servers, matching the known webshell deployment technique where attackers modify or introduce error-handling JSP files to host malicious code. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious POST Request to JSP Error Page on Ivanti EPMM
description: Detects HTTP POST requests to JSP error pages, which is the reported
technique for deploying webshells on compromised Ivanti EPMM appliances (modified
401.jsp or similar error handler files). Error pages normally only receive GET requests
from the servlet container, so POST activity is anomalous.
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains|all:
- err
- .jsp
filter_known_uris:
cs-uri-stem|contains:
- /mifs/
- /health
condition: selection and not filter_known_uris
falsepositives:
- Legitimate application health-check or monitoring tooling submitting POST bodies
to error handlers
- Custom internal error-reporting integrations that intentionally POST to error pages
level: high
id: 3253dfc5-19ed-50ae-9dd6-ade5b26b79d7
status: experimental
author: Vorant
Java Web Application Process Spawning Shell Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java process (Tomcat/EPMM service) spawning a shell interpreter such as sh or bash, consistent with webshell or reverse-shell command execution following exploitation of the Ivanti EPMM RCE vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Web Application Process Spawning Shell Interpreter
description: Detects child shell processes (sh, bash, dash) spawned from a Java process,
as observed when webshells or reverse shells are executed on compromised Ivanti
EPMM/Tomcat appliances after exploitation of an unauthenticated RCE vulnerability.
Legitimate EPMM operation does not normally require the application server to spawn
interactive shells.
tags:
- attack.execution
- attack.t1059
- attack.t1505.003
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: java
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
filter_known_scripts:
CommandLine|contains:
- /opt/mi/
- logrotate
condition: selection and not filter_known_scripts
falsepositives:
- Legitimate administrative scripts invoked by the application server for scheduled
maintenance tasks
- Custom EPMM plugins or health-check scripts that shell out for system calls
level: high
id: d6bfa54c-a5eb-52e0-b67c-da575dfbae25
status: experimental
author: Vorant
Long-Lived Outbound Network Connection from Java Web Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an outbound network connection initiated by a Java-based web server process to an external destination on an uncommon port, consistent with reverse-shell command-and-control traffic reported on exploited Ivanti EPMM appliances. Sustained or long-duration connections from this process should be treated as high-priority; the exact duration threshold should be tuned against baseline traffic in the SIEM rather than encoded here. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Long-Lived Outbound Network Connection from Java Web Server Process
description: Detects a Java web-application process (e.g. Tomcat hosting Ivanti EPMM)
initiating outbound network connections to non-standard high ports, which matches
the reported reverse-shell persistence mechanism. Analysts should correlate with
connection duration/volume in the SIEM, since long-lived sessions are the key discriminator
described in the report and cannot be expressed as a Sigma aggregation condition.
tags:
- attack.command-and-control
- attack.t1071
logsource:
category: network_connection
product: linux
detection:
selection:
Image|contains: java
Initiated: true
DestinationPort:
- 4444
- 8443
- 8888
- 9001
filter_local:
DestinationIp|startswith:
- '10.'
- 192.168.
- 172.16.
condition: selection and not filter_local
falsepositives:
- Legitimate outbound integrations from the EPMM Java process to management or MDM
backend services on non-standard ports
- Load balancer or health-check services connecting on similar high ports
level: medium
id: 4cc8ce7a-4132-591f-a2ce-03c70b0f873d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-001
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs