Ivanti Exploitation Surges: Zero-Day Attacks Traced Back to July 2025 Vulnerabilities

Post Views: 14

Cyber Attackers Exploit Ivanti Endpoint Manager Mobile Vulnerabilities

Cyber attackers have been actively exploiting two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) since July 2025, according to recent reports from Palo Alto Networks and Germany’s national cybersecurity agency, BSI.

Vulnerabilities and Exploitation

The vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340, were patched by Ivanti in late January, but not before they were exploited by remote, unauthenticated attackers to execute arbitrary code on target servers and gain control of the mobile device management (MDM) infrastructure.

According to BSI, evidence of attacks dating back to the summer of 2025 has been reported.

The exploitation of these vulnerabilities is not new, but the widespread exploitation started soon after Ivanti disclosed the patches in January. Palo Alto Networks has observed a wide range of attacks, including the deployment of the Nezha open-source monitoring utility, reverse shell execution, and reconnaissance activities.

Impact and Recommendations

The attackers have been using these vulnerabilities to gain access to the targeted MDM infrastructure, allowing them to execute malicious code and potentially compromise the security of the mobile devices managed by the affected systems.

The exploitation of these vulnerabilities highlights the importance of keeping software up-to-date and applying security patches in a timely manner.

Ivanti products have been a popular target for cyber attackers in the past, with over 30 Ivanti flaws listed in the CISA’s Known Exploited Vulnerabilities (KEV) catalog.

Some of the most significant attacks linked to Chinese state-sponsored threat actors have involved Ivanti products.

Organizations are advised to check their systems for indicators of compromise (IoCs) related to these vulnerabilities, dating back to July 2025.

The BSI has urged organizations to take immediate action to protect themselves against these attacks, as the exploitation of these vulnerabilities can have severe consequences for the security of their mobile devices and infrastructure.

Response and Prevention

In response to the surge in exploitation, organizations should ensure that their Ivanti EPMM systems are updated with the latest security patches and that they have implemented robust security measures to detect and prevent similar attacks in the future.