CVE-2026-1281: listed in the CISA KEV catalog
CVE-2026-1281 · CVSS 9.8 CRITICAL · EPSS 99% · KEV 2026-01-29 · patch available
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Is CVE-2026-1281 exploited?
- Listed in the CISA KEV catalog on 2026-01-29.
- Federal remediation due 2026-02-01.
- Past that date by 242 days.
- EPSS puts exploitation in the next 30 days at 99%.
- Public exploit code: packaged in a public tool.
- Public detection rules exist.
Which products and versions are affected?
- Ivanti · Endpoint Manager Mobile
Is there a patch?
- Endpoint Manager Mobile 12.x.1.x RPM, 12.x.0.x RPM
What PlainSec published about CVE-2026-1281
PlainSec has not published a story about this CVE.
Primary sources
KEV and EPSS are re-checked daily. Record last updated 2026-09-26.