Tag: ivanti
-
One threat actor responsible for 83% of recent Ivanti RCE attacks
Tags: attack, cve, endpoint, exploit, intelligence, ivanti, mobile, rce, remote-code-execution, threat, vulnerabilityThreat intelligence observations show that a single threat actor is responsible for most of the active exploitation of two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-21962 and CVE-2026-24061. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/one-threat-actor-responsible-for-83-percent-of-recent-ivanti-rce-attacks/
-
CVE-2026-1281 CVE-2026-1340: Actively Exploited Pre-Authentication RCE in Ivanti EPMM
Learn how CVE-2026-1281 and CVE-2026-1340 enable pre-auth RCE in Ivanti EPMM, now actively exploited, and how AppTrana helps block attacks across applications. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/cve-2026-1281-cve-2026-1340-actively-exploited-pre-authentication-rce-in-ivanti-epmm/
-
Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy, Again
It’s time to phase out the patch and pray approach, eliminate needless public interfaces, and enforce authentication controls, one expert says. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/ivanti-epmm-zero-day-bugs-exploit
-
Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy, Again
It’s time to phase out the patch and pray approach, eliminate needless public interfaces, and enforce authentication controls, one expert says. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/ivanti-epmm-zero-day-bugs-exploit
-
Ivanti EPMM Zero-Day Bugs Spark Exploit Frenzy, Again
It’s time to phase out the patch and pray approach, eliminate needless public interfaces, and enforce authentication controls, one expert says. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/ivanti-epmm-zero-day-bugs-exploit
-
83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure
A significant chunk of the exploitation attempts targeting a newly disclosed security flaw in Ivanti Endpoint Manager Mobile (EPMM) can be traced back to a single IP address on bulletproof hosting infrastructure offered by PROSPERO.Threat intelligence firm GreyNoise said it recorded 417 exploitation sessions from 8 unique source IP addresses between February 1 and 9,…
-
Multiple Endpoint Manager bugs patched by Ivanti, including remote auth bypass
Ivanti patched over a dozen Endpoint Manager flaws, including a high-severity auth bypass that let attackers steal credentials remotely. Ivanti released patches for more than a dozen vulnerabilities in Endpoint Manager, including flaws disclosed in October 2025. The update addresses a high-severity authentication bypass, tracked as CVE-2026-1603 (CVSS score of 8.6), that attackers could exploit…
-
Majority of Ivanti EPMM threat activity linked to hidden IP
A report by GreyNoise warns the IP address is operating behind bulletproof hosting infrastructure and might not show up in current IoCs.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/majority-ivanti-epmm-hidden-ip/811960/
-
Ivanti EPMM exploitation widespread as governments, others targeted
Researchers warn the activity shows evidence of initial access brokers preparing for future attacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ivanti-epmm-exploitation-widespread-as-governments-others-targeted/811827/
-
Cyberangriff auf EU-Kommission
Tags: advisory, authentication, bug, cve, cvss, cyberattack, endpoint, exploit, germany, ivanti, mail, mobile, usa, vulnerabilityCyberkriminellen ist es gelungen, in ein System der EU-Kommission einzudringen.Die Europäische Kommission wurde Ziel einer Cyberattacke. Wie aus einer kürzlich veröffentlichten Mitteilung hervorgeht, erfolgte der Angriff Ende Januar und zielte auf ein System zur Verwaltung mobiler Endgeräte ab (Mobile Device Management MDM) .Demnach sind die Täter möglicherweise an Namen und Rufnummern einiger Mitarbeiter gekommen. Es…
-
Dutch agencies hit by Ivanti EPMM exploit exposing employee contact data
Dutch agencies confirmed attacks exploiting Ivanti EPMM flaws that exposed employee contact data at the data protection authority and courts. Dutch authorities said cyberattacks hit the Dutch Data Protection Authority and the Council for the Judiciary after hackers exploited newly disclosed flaws in Ivanti Endpoint Manager Mobile (EPMM). The incidents were reported to parliament, and…
-
European Governments Breached in Zero-Day Attacks Targeting Ivanti
The European Commission and government agencies in Finland and the Netherlands have suffered potentially related breaches First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/european-governments-zeroday/
-
Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data
The Netherlands’ Dutch Data Protection Authority (AP) and the Council for the Judiciary confirmed both agencies (Rvdr) have disclosed that their systems were impacted by cyber attacks that exploited the recently disclosed security flaws in Ivanti Endpoint Manager Mobile (EPMM), according to a notice sent to the country’s parliament on Friday.”On January 29, the National…
-
Threat Actors Using Ivanti EPMM Flaws to Install Stealth Backdoors
A sophisticated new cyber campaign has been detected targeting Ivanti Endpoint Manager Mobile (EPMM) systems. Starting on February 4, 2026, threat actors began exploiting two critical vulnerabilities, CVE-2026-1281 and CVE-2026-1340, to plant dormant backdoors. Unlike typical attacks that immediately steal data or deploy ransomware, this campaign focuses on silence and persistence. Stealth Backdoors The attackers…
-
Fallout from latest Ivanti zero-days spreads to nearly 100 victims
Shadowserver scans have identified 86 compromised instances, and researchers warn multiple threat groups are involved. First seen on cyberscoop.com Jump to article: cyberscoop.com/ivanti-zero-day-vulnerabilities-netherlands-european-commission-shadowserver/
-
Ivanti Zero-Days Likely Deployed in EU and Dutch Hacks
Ivanti’s Endpoint Manager Mobile Flaws Under Active Exploitation. The European Commission fell victim to a cyberattack that could have allowed the theft of some staff personal information. The European Union’s executive body said Friday it detected on Jan. 30 an attack on its central infrastructure managing mobile devices. First seen on govinfosecurity.com Jump to article:…
-
Dutch data watchdog snitches on itself after getting caught in Ivanti zero-day attacks
Staff data belonging to the regulator and judiciary’s governing body accessed First seen on theregister.com Jump to article: www.theregister.com/2026/02/09/dutch_data_protection_ivanti/
-
EU, Dutch government announce hacks following Ivanti zero-days
Ivanti said it was aware “a very limited number of customers” had been attacked while two vulnerabilities were still unpatched. First seen on therecord.media Jump to article: therecord.media/eu-dutch-government-announce-hacks-ivanti-zero-days
-
EU, Dutch government announce hacks following Ivanti zero-days
Ivanti said it was aware “a very limited number of customers” had been attacked while two vulnerabilities were still unpatched. First seen on therecord.media Jump to article: therecord.media/eu-dutch-government-announce-hacks-ivanti-zero-days
-
Lateral Movement und RCE – Angriffe über Ivanti Endpoint Manager Mobile laufen
First seen on security-insider.de Jump to article: www.security-insider.de/sicherheitsluecken-ivanti-endpoint-manager-mobile-updates-a-aca050adf9926475b601d024c1aaff43/
-
Breach Roundup: Italy Thwarts Russian Olympic Hacks
Also, Active Exploits Hit SolarWinds, Ivanti as APT28 Targets EU, Ukraine. This week, Italy blocked Russian cyberattacks targeting the Olympics. Flaws in SolarWinds, Ivanti and Microsoft Office. Russia’s APT28 ramped up attacks in Ukraine, supply chain attacks, regulators probed major breaches and a U.S. judge sentenced the operator of a darkweb drug marketplace. First seen…
-
Ivanti’s EPMM is under active attack, thanks to two critical zero-days
Limited attacks occurred prior to Ivanti’s disclosure, followed by mass exploitation by multiple threat groups. More than 1,400 potentially vulnerable instances remain exposed. First seen on cyberscoop.com Jump to article: cyberscoop.com/ivanti-endpoint-manager-mobile-zero-day-vulnerabilities-exploit/
-
Critical flaws in Ivanti EPMM lead to fast-moving exploitation attempts
Security researchers warn that the initial threat activity was highly targeted, as a limited number of users were impacted prior to disclosure. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaws-ivanti-epmm-exploitation/811228/
-
Ivanti Issues Urgent Fix for Critical Zero-Day Flaws Under Active Attack
Ivanti has disclosed two critical remote code execution (RCE) flaws (CVE-2026-1281 CVE-2026-1340) in its EPMM software. First seen on hackread.com Jump to article: hackread.com/ivanti-urgent-fix-critical-zero-day-vulnerabilities/
-
Ivanti Issues Urgent Fix for Critical Zero-Day Flaws Under Active Attack
Ivanti has disclosed two critical remote code execution (RCE) flaws (CVE-2026-1281 CVE-2026-1340) in its EPMM software. First seen on hackread.com Jump to article: hackread.com/ivanti-urgent-fix-critical-zero-day-vulnerabilities/
-
Ivanti patches two actively exploited critical vulnerabilities in EPMM
install rpm url [patch_url] command.The RPM_12.x.0.x patch is applicable to EPMM software versions 12.5.0.x, 12.6.0.x, and 12.7.0.x. It is also compatible with the older 12.3.0.x and 12.4.0.x versions. Meanwhile the RPM_12.x.1.x patch is applicable to versions 12.5.1.0 and 12.6.1.0.”The RPM script does not survive a version upgrade,” the company warns. “If after applying the RPM…
-
January blues return as Ivanti coughs up exploited EPMM zero-days
Consider yourselves compromised, experts warn First seen on theregister.com Jump to article: www.theregister.com/2026/01/30/ivanti_epmm_zero_days/
-
Ivanti Fixes Actively Exploited RCE Flaws in Endpoint Manager Mobile
Ivanti patched actively exploited EPMM flaws that enable unauthenticated remote code execution. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/ivanti-fixes-actively-exploited-rce-flaws-in-endpoint-manager-mobile/
-
‘Critical’ Mobile Management Vulnerabilities Seeing Exploitation
A pair of critical-severity vulnerabilities affecting an Ivanti mobile management tool have been exploited in cyberattacks, according to the company. First seen on crn.com Jump to article: www.crn.com/news/security/2026/ivanti-critical-mobile-management-vulnerabilities-seeing-exploitation
-
Ivanti Endpoint Manager Vulnerability Allows Remote Code Execution,
Ivanti has disclosed two critical vulnerabilities affecting Endpoint Manager Mobile (EPMM) that could allow attackers to achieve unauthenticated remote code execution. The flaws, tracked as CVE-2026-1281 and CVE-2026-1340, both stem from code injection issues and carry a maximum CVSS severity score of 9.8, indicating critical risk to affected deployments. Vulnerability Overview Both vulnerabilities enable attackers…