Code Injection in Endpoint Manager Mobile (formerly MobileIron Core) - CVE-2026-1281

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote non-authenticated attacker can send a specially crafted request to the application and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild. 

How to mitigate CVE-2026-1281

The vulnerability is addressed in the RPM 12.x.0.x patch:
https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0S-5.noarch.rpm 

and RPM 12.x.1.x patch:
https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-security-update-1761642-1.0.0L-5.noarch.rpm 

The permanent fix for this vulnerability will be included in the next product release: 12.8.0.0. 

Sources

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340
• https://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340