U.S. CISA adds a flaw in Ivanti EPMM to its Known Exploited Vulnerabilities catalog

A critical code injection vulnerability in Ivanti EPMM, tracked as CVE-2026-1340 with a CVSS score of 9.8, has been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog¹. This flaw allows attackers to achieve unauthenticated remote code execution in Ivanti Endpoint Manager Mobile, posing a significant threat to affected systems. The vulnerability affects specific versions of the product, highlighting the need for urgent attention from administrators. As CVE-2026-1340 is under active discussion involving CISA, its exploitation status will determine whether immediate patching or monitoring is required. This vulnerability matters to practitioners because it underscores the importance of promptly addressing known exploits to prevent potential breaches, particularly given the vulnerability's high CVSS score and potential for remote code execution.