VORANT. Threat Intelligence Sign in Get the full feed

Ivanti EPMM zero-days exploited in targeted attacks

critical threat government-nationaltechnology

Two critical unauthenticated RCE vulnerabilities in Ivanti Endpoint Manager Mobile are being actively exploited, with attackers deploying webshells and reverse shells for persistence.

CERT-FR issued an alert regarding CVE-2026-1281 and CVE-2026-1340, two critical vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.x through 12.7.0.x. Ivanti confirmed these flaws allow unauthenticated attackers to achieve remote code execution and are being actively exploited in targeted attacks as of the January 29, 2026 advisory. A public proof-of-concept became available on February 2, 2026, increasing the risk of broader exploitation.

Ivanti has identified two known persistence mechanisms used by attackers: deployment of malicious webshells (via modified HTTP error pages such as 401.jsp or introduced WAR/JAR files) and reverse shell command prompts. Defenders are advised to inspect Apache access logs (/var/log/httpd/https-access_log) for suspicious POST requests to error pages or long-duration outbound connections indicative of reverse shell activity. Ivanti released RPM-based detection scripts on February 6, 2026, though these patches are described as temporary until version 12.8.0.0 is released.

Organizations with compromised EPMM instances are urged to isolate affected devices (including associated Sentry appliances) from all networks, restore from clean backups or rebuild the system, and reset all local, LDAP, KDC, and service account credentials, as well as revoke and replace public certificates. Given the unauthenticated RCE nature, active exploitation, and public PoC availability, this represents a significant edge-device compromise risk consistent with CERT-FR's network perimeter compromise guidance.

Mentioned in this report

Vulnerabilities CVE-2026-1281KEVCVE-2026-1340KEV
Malware Webshell (401.jsp / WAR/JAR-based)

Detection guidance

Suspicious POST Request to JSP Error Page on Ivanti EPMM

ATT&CK T1505.003

Detects POST requests to JSP error pages (e.g. 401.jsp) on Ivanti EPMM/Tomcat servers, matching the known webshell deployment technique where attackers modify or introduce error-handling JSP files to host malicious code. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious POST Request to JSP Error Page on Ivanti EPMM
description: Detects HTTP POST requests to JSP error pages, which is the reported
  technique for deploying webshells on compromised Ivanti EPMM appliances (modified
  401.jsp or similar error handler files). Error pages normally only receive GET requests
  from the servlet container, so POST activity is anomalous.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains|all:
    - err
    - .jsp
  filter_known_uris:
    cs-uri-stem|contains:
    - /mifs/
    - /health
  condition: selection and not filter_known_uris
falsepositives:
- Legitimate application health-check or monitoring tooling submitting POST bodies
  to error handlers
- Custom internal error-reporting integrations that intentionally POST to error pages
level: high
id: 3253dfc5-19ed-50ae-9dd6-ade5b26b79d7
status: experimental
author: Vorant

Java Web Application Process Spawning Shell Interpreter

ATT&CK T1059

Detects a Java process (Tomcat/EPMM service) spawning a shell interpreter such as sh or bash, consistent with webshell or reverse-shell command execution following exploitation of the Ivanti EPMM RCE vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Web Application Process Spawning Shell Interpreter
description: Detects child shell processes (sh, bash, dash) spawned from a Java process,
  as observed when webshells or reverse shells are executed on compromised Ivanti
  EPMM/Tomcat appliances after exploitation of an unauthenticated RCE vulnerability.
  Legitimate EPMM operation does not normally require the application server to spawn
  interactive shells.
tags:
- attack.execution
- attack.t1059
- attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: java
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
  filter_known_scripts:
    CommandLine|contains:
    - /opt/mi/
    - logrotate
  condition: selection and not filter_known_scripts
falsepositives:
- Legitimate administrative scripts invoked by the application server for scheduled
  maintenance tasks
- Custom EPMM plugins or health-check scripts that shell out for system calls
level: high
id: d6bfa54c-a5eb-52e0-b67c-da575dfbae25
status: experimental
author: Vorant

Long-Lived Outbound Network Connection from Java Web Server Process

ATT&CK T1071

Detects an outbound network connection initiated by a Java-based web server process to an external destination on an uncommon port, consistent with reverse-shell command-and-control traffic reported on exploited Ivanti EPMM appliances. Sustained or long-duration connections from this process should be treated as high-priority; the exact duration threshold should be tuned against baseline traffic in the SIEM rather than encoded here. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Long-Lived Outbound Network Connection from Java Web Server Process
description: Detects a Java web-application process (e.g. Tomcat hosting Ivanti EPMM)
  initiating outbound network connections to non-standard high ports, which matches
  the reported reverse-shell persistence mechanism. Analysts should correlate with
  connection duration/volume in the SIEM, since long-lived sessions are the key discriminator
  described in the report and cannot be expressed as a Sigma aggregation condition.
tags:
- attack.command-and-control
- attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains: java
    Initiated: true
    DestinationPort:
    - 4444
    - 8443
    - 8888
    - 9001
  filter_local:
    DestinationIp|startswith:
    - '10.'
    - 192.168.
    - 172.16.
  condition: selection and not filter_local
falsepositives:
- Legitimate outbound integrations from the EPMM Java process to management or MDM
  backend services on non-standard ports
- Load balancer or health-check services connecting on similar high ports
level: medium
id: 4cc8ce7a-4132-591f-a2ce-03c70b0f873d
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-001

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free