CVE-2026-1281 CRITICAL

CVE-2026-1281

Weakness CWE-94 · Code injection

KEV Status Known Exploited

Published January 29, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Key dates

03Disclosure timeline

January 29, 2026 CVE published

February 26, 2026 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1281 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html CISA KEV Reference https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-E… CISA KEV Reference https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-securit… CISA KEV Reference https://support.mobileiron.com/mi/vsp/AB1771634/ivanti-securit… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2026-1281