DIVD-2026-00002 - DIVD-2026-00002 – Ivanti Endpoint Manager Mobile Vulnerabilities

Summary

Two critical vulnerabilities have been found in in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron. One of these vulnerabilities is actively exploited in the wild, and public Proof-of-Concept (PoC) exploit code is available.

Organizations using Ivanti EPMM are strongly advised to apply patches immediately and assume compromise if systems were exposed prior to mitigation.

What is happening?

Ivanti has released security updates addressing two vulnerabilities that allow remote code execution without authentication. According to Ivanti, targeted attacks exploiting one of these vulnerabilities have already been observed.

The availability of PoC code significantly increases the risk of widespread exploitation.

What we are doing

We are scanning for Ivanti Endpoint Manager Mobile (EPMM) instances exposed to the internet that may be vulnerable to these flaws. We will notify affected parties so they can take appropriate action.

Technical Details

Affected Product

• Ivanti Endpoint Manager Mobile (EPMM / MobileIron)

Other Ivanti products, such as Ivanti EPM, Ivanti Neurons for MDM, and Ivanti Sentry, are not affected.

Impact

Successful exploitation can result in:

• Full system compromise
• Unauthorized access to sensitive data
• Persistence mechanisms installed by attackers
• Lateral movement within enterprise environments

Due to confirmed active exploitation, the impact should be considered severe for unpatched systems.

Mitigation and Recommendations

Immediate Actions

• Apply Ivanti security updates for EPMM immediately
• Treat systems as potentially compromised if exposed prior to patching
• Rotate credentials and cryptographic keys associated with affected systems
• Review logs and network traffic for signs of exploitation or lateral movement

Additional Measures

• Perform threat hunting focused on EPMM exploitation techniques
• Rebuild affected systems if compromise is suspected
• Monitor vendor and NCSC updates for additional indicators of compromise

Timeline

References

• NCSC Advisory NCSC-2026-0043

• NCSC Warning on Ivanti Endpoint Manager Mobile

• Ivanti Security Updates