{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-1281/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-1281/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-1281/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-1281/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-1281/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-1281"},"sightings":{"href":"/api/v1/sightings/cve-2026-1281"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-1281.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-1281\n\ninfo:\n  name: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection\n  author: rxerium\n  severity: critical\n  description: |\n    Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary code on the EPMM appliance, leading to full system compromise. This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.\n  remediation: |\n    Apply the Ivanti security patch for EPMM or upgrade to a version above 12.7.0.0. Restrict network access to the EPMM management interface.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1281\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n    - https://www.helpnetsecurity.com/2026/01/30/ivanti-epmm-cve-2026-1281-cve-2026-1340/\n    - https://www.cisa.gov/news-events/alerts/2026/01/29/cisa-adds-one-known-exploited-vulnerability-catalog\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1281\n    epss-score: 0.98575\n    epss-percentile: 0.99921\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ivanti\n    product: endpoint-manager-mobile\n    shodan-query: product:\"Ivanti Endpoint Manager Mobile (EPMM)\"\n  tags: cve,cve2026,ivanti,epmm,code-injection,rce,unauth,kev,vkev,passive\n\nhttp:\n  - raw:\n      - |\n        GET /mics/login.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<title>Ivanti System Manager: Sign In\")'\n          - 'contains(body, \"Ivanti. All rights reserved.\")'\n        condition: and\n\n      - type: dsl\n        dsl:\n          - '(compare_versions(version, \">= 12.5.0.0\") && compare_versions(version, \"< 12.6.0.0\")) || (compare_versions(version, \">= 12.6.0.0\") && compare_versions(version, \"<= 12.7.0.0\"))'\n\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '<div[^>]*class=\"[^\"]*product-version[^\"]*\"[^>]*>\\s*([0-9.]+)\\s*</div>'\n\n      - type: regex\n        name: detected_version\n        part: body\n        group: 1\n        regex:\n          - '<div[^>]*class=\"[^\"]*product-version[^\"]*\"[^>]*>\\s*([0-9.]+)\\s*</div>'\n# digest: 4b0a00483046022100b49b10b9a16db078ea1cdb53f3bf076753dafe6b8e85a393bf2e27224db0325d022100baaec9fa38da93ebe48f24fd9718a945983ddaf8ef52a5ecda88f360850d92f7:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-1281"}