{"uuid": "63ab117e-d589-4b3a-bae0-534ecacaf0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1340", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_epmm_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"watchTowr\", \"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a OS command injection issue in Ivanti Endpoint Manager Mobile (EPMM), formerly known\\n          as MobileIron. A remote attacker can achieve unauthenticated RCE with root privileges on an affected device.\", \"disclosure_date\": \"2026-01-29\", \"fullname\": \"exploit/linux/http/ivanti_epmm_rce\", \"is_install_path\": true, \"mod_time\": \"2026-02-06 14:52:00 +0000\", \"name\": \"Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/ivanti_epmm_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/ivanti_epmm_rce\", \"references\": [\"CVE-2026-1281\", \"CVE-2026-1340\", \"URL-https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US\", \"URL-https://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US\", \"URL-https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:40.859334Z"}