CVE-2026-1340 CRITICAL

CVE-2026-1340

Weakness CWE-94 · Code injection

KEV Status Known Exploited

Published January 29, 2026

Last update April 9, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Key dates

03Disclosure timeline

January 29, 2026 CVE published

April 9, 2026 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-1340 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html CISA KEV Reference https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endp… CISA KEV Reference https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-securit… CISA KEV Reference https://support.mobileiron.com/mi/vsp/AB1786671/ivanti-securit… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2026-1340