Vulnerability
Campaign
Exploitation Wave
Incident
Security Patch Release
Ivanti Endpoint Manager Mobile zero-day exploitation, European government breaches, and concentrated attack wave
Updated 08.04.2026 21:15
Case score 71
Score breakdown
- Total
- 71
- Lead score
- 64
- Support bonus
- +0 / 20
- Scoring support
- 3
- Context members
- 1
Top contributors
- Vulnerability Anchor event for the exploited **Ivanti EPMM** flaws, zero-day activity, affected versions, and response timeline. base
- Campaign Adds coordinated European government breach context, broader data exposure, and follow-on risk. support
- Security Patch Release Adds vendor fixes, KEV urgency, and the upgrade caveat for the same EPMM exposure. context
- Incident Adds confirmed European Commission fallout and limited staff-data exposure from the same exposure. support
Title history
-
Old: Ivanti Endpoint Manager Mobile zero-day exploitation, European government data theft, and concentrated exploitation waveNew: Ivanti Endpoint Manager Mobile zero-day exploitation, European government breaches, and concentrated attack waveWhy old title changed: The previous title leaned on a data-theft framing and did not fully reflect the later, more specific breach disclosures and the concentrated February attack wave now visible in the record.The new title better matches the current evidence by foregrounding confirmed European government breaches and the sustained attack wave without overcommitting to a theft-only interpretation.
-
Old: Ivanti Endpoint Manager Mobile zero-day exploitation and European government data theft campaignNew: Ivanti Endpoint Manager Mobile zero-day exploitation, European government data theft, and concentrated exploitation waveWhy old title changed: The prior title captured the zero-day exploitation and European government fallout, but it did not reflect the later concentrated wave of live targeting against the same exposure.The new title keeps the product and fallout framing while adding the active exploitation wave that now shapes current reader priority.
-
Old: Ivanti Endpoint Manager Mobile zero-day exploitation and European public-sector compromiseNew: Ivanti Endpoint Manager Mobile zero-day exploitation and European government data theft campaignWhy old title changed: The earlier title captured exploitation and public-sector compromise, but it no longer reflected the coordinated multi-institution campaign and broader government data exposure now confirmed.The new title keeps the exploited EPMM flaws front and center while better capturing the campaign-style fallout and government data exposure that now define the story.
-
Old: Ivanti Endpoint Manager Mobile zero-day exploitation of critical code-injection flawsNew: Ivanti Endpoint Manager Mobile zero-day exploitation and European public-sector compromiseWhy old title changed: The earlier title captured the flaws and exploitation but no longer fully reflected the confirmed European public-sector compromise that followed.The new title keeps the EPMM zero-day focus while better signaling the now-confirmed public-sector fallout and reader priority.
Case score 71
Members 5
Latest activity 08.04.2026 21:15
Active exploitation
KEV: CISA KEV
Patch available
Permanent fix: EPMM 12.8.0.0 planned
Active exploitation
KEV: CISA KEV
Patch available
Permanent fix: EPMM 12.8.0.0 planned
Members 5
First seen 30.01.2026 06:43
Last seen 12.02.2026 09:32
Updated 08.04.2026 21:15
Overview
**Ivanti Endpoint Manager Mobile (EPMM)** remains under active zero-day exploitation for **CVE-2026-1281** and **CVE-2026-1340**, two critical code-injection flaws that allow unauthenticated remote code execution. A concentrated February exploitation wave later logged **417 sessions** from eight source IPs, and Shadowserver tracked a more voluminous Feb. 9 burst against European government targets.
Confirmed fallout reaches the **European Commission**, the **Finnish government**, and at least two Dutch agencies, with staff contact details and device information exposed in some incidents. Patches are available, **CISA** has placed both flaws in the **KEV catalog** with federal deadlines on **February 1** and **April 11**, and compromise review remains warranted for exposed deployments.
**Ivanti Endpoint Manager Mobile (EPMM)** remains under active zero-day exploitation after attackers began targeting **CVE-2026-1281** and **CVE-2026-1340**, two code-injection flaws that allow unauthenticated remote code execution. GreyNoise logged **417 exploitation sessions** from **8 unique source IPs** between **February 1 and 9, 2026**, with **193.24.123[.]42** generating **346 sessions** and accounting for **83%** of the attempts. Shadowserver also tracked a more voluminous Feb. 9 attack spike against European government targets, while GreyNoise said the activity used DNS callbacks to verify exploitability and rotated through 300+ user-agent strings. The flaws carry **CVSS 9.8** scores and affect multiple EPMM release lines.
Ivanti released security updates on **January 29, 2026**, and **CISA** later added **CVE-2026-1281** to the **KEV catalog** with a **February 1** deadline for federal civilian executive branch agencies. On **April 8**, CISA added **CVE-2026-1340** to KEV and ordered FCEB agencies to patch by **April 11** under **BOD 22-01**. Administrators were told to review Apache access logs, inspect administrative and configuration changes, and watch for attempted or successful exploitation, and Ivanti said the RPM fix must be reapplied after any version upgrade before the permanent **EPMM 12.8.0.0** release later in Q1 2026.
The **European Commission** disclosed a breach investigation after finding evidence that its mobile device management platform had been hacked, and later public disclosures by the Dutch justice and security secretary and Finnish government ICT centre **Valtori** confirmed related compromise across government mobile-management services. The Commission said the system was contained and cleaned within **nine hours**, while Valtori said as many as **50,000** government workers may have had their details exposed. Reported exposure included staff names, mobile numbers, work email addresses, telephone numbers, and device details, and the same EPMM exposure raises follow-on risk of spearphishing, impersonation, and deeper access attempts against government networks.
Update history
-
27.05.2026 17:58 · updatedChanged: case_title, case_identity_v1, case_summary, executive_brief_v1, case_detailed_summary_v1, case_key_facts_v1, case_narrative_links_v1, activity_story_v1, defender_view_v1, threat_and_technical_context_v1, scope_and_limits_v1, member_map_v1, case_member_admission_v1Reason: Updated to reflect CISA's later KEV action for CVE-2026-1340, the Feb. 9 attack spike tracked by Shadowserver and GreyNoise, and the public-disclosure details from the European Commission, Valtori, and Dutch authorities.