Edge Fatigue: How Two 9.8 Zero-Days are Dismantling Ivanti’s Mobile Management Fleet

Two nascent zero-day vulnerabilities within the Ivanti mobile device management ecosystem are currently being exploited in live offensives, with the scale of compromise far exceeding isolated incidents. Adversaries are engaged in the mass-scanning of exposed servers to exert total dominion over them, bypassing authentication protocols without requiring user interaction.

The vulnerabilities, cataloged as CVE-2026-1281 and CVE-2026-1340 in Ivanti Endpoint Manager Mobile (EPMM), have both garnered a near-maximum CVSS score of 9.8. They facilitate arbitrary remote code execution on the servers governing corporate smartphones and tablets. Consequently, an aggressor may effectively usurp control over the entire mobile management infrastructure.

According to data from Palo Alto Networks’ Unit 42, these assaults are pervasive and predominantly automated. Threat actors are deploying reverse shells, uploading deleterious payloads, conducting reconnaissance, and establishing web shells for persistent access. The campaign has impacted government and municipal entities, healthcare providers, industrial firms, legal practices, and the technology sector across the United States, Germany, Australia, and Canada. CISA has formally added CVE-2026-1281 to its Known Exploited Vulnerabilities Catalog, signifying a high-velocity risk to global organizations.

The primary flaw resides within legacy Bash scripts utilized by the Apache web server for URL processing. This defect permits the injection of commands via meticulously crafted HTTP GET requests. Adversaries often employ the sleep 5 command as a rudimentary diagnostic; if the server’s response is delayed by five seconds, the execution is confirmed, paving the way for more sophisticated payloads. The secondary vulnerability implicates the file transfer mechanism for Android devices, stemming from similar insecure data handling in a separate Bash component.

In several instances, attackers bypassed the MobileIron authentication layer to immediately deploy secondary-stage malware, frequently installing web shells—such as 401.jsp or 1.jsp—within the web application directory. If the server operates with administrative privileges, the adversary gains unfettered system access. Furthermore, researchers identified attempts to deploy the Nezha agent for server monitoring and botnet integration.

Palo Alto Networks estimates that over 4,400 Ivanti EPMM instances remain accessible via the public internet, representing a significant attack surface. Ivanti released a security remediation in January 2026, advising the immediate installation of the relevant RPM packages. The update is non-disruptive and does not necessitate downtime. Nevertheless, the manufacturer urges organizations to conduct comprehensive forensic audits, as attackers may retain a clandestine presence even after the patch is applied.

This situation underscores the near-total evaporation of the “window of opportunity” between vulnerability disclosure and mass exploitation. Threat actors now integrate new CVEs into their scanning armaments within hours. Entities with internet-facing management interfaces should operate under the assumption of prior compromise, scrutinizing their infrastructure not only for missing patches but for subtle indicators of lateral movement and persistence.