Ivanti · Endpoint Manager Mobile (EPMM)
CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
공격에 악용됨
치명적 9.8 공격 가능성: 99%
무엇인가
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CISA: Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
할 일
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2026년 2월 1일
Ivanti의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 5. 7. | Improper Input Validation | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 34% |
| 2026. 4. 8. | Code Injection | Endpoint Manager Mobile (EPMM) | 치명적 9.8 | 99% |
| 2025. 5. 19. | Authentication Bypass | Endpoint Manager Mobile (EPMM) | 보통 5.3 | 99.9% |
| 2025. 5. 19. | Code Injection | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 88% |
| 2023. 7. 31. | Path Traversal | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 64% |
| 2023. 7. 25. | Endpoint Manager Mobile Authentication Bypass | Endpoint Manager Mobile (EPMM) | 치명적 10.0 | >99.9% |
| 2026. 10. 30. | Missing Authentication for Critical Function | Connect Secure | 높음 7.0 | 0.5% |
| 2026. 10. 30. | Generation of Predictable Numbers or Identifiers | Connect Secure | 0.8% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.