CVE-2026-1340: listed in the CISA KEV catalog
CVE-2026-1340 · CVSS 9.8 CRITICAL · EPSS 84% · KEV 2026-04-08
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
Is CVE-2026-1340 exploited?
- Listed in the CISA KEV catalog on 2026-04-08.
- Federal remediation due 2026-04-11.
- Past that date by 126 days.
- EPSS puts exploitation in the next 30 days at 84%.
- Public exploit code: packaged in a public tool.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2026-1340
PlainSec has not published a story about this CVE.
Primary sources
What this record does not say
- No affected package data.
- No patch identifier.
KEV and EPSS are re-checked daily. Record last updated 2026-08-11.