#VU122130 Code Injection in Endpoint Manager Mobile (formerly MobileIron Core) - CVE-2026-1281

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote non-authenticated attacker can send a specially crafted request to the application and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild. 

Remediation

The vulnerability is addressed in the RPM 12.x.0.x patch:
https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0S-5.noarch.rpm 

and RPM 12.x.1.x patch:
https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0L-5.noarch.rpm 

The permanent fix for this vulnerability will be included in the next product release: 12.8.0.0. 

External links

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340
• https://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340