This vulnerability is an RCE vulnerability found in Ivanti Endpoint Manager Mobile. An attacker could attempt an attack by sending a request with a malicious OS command appended to the /mifs/c/appstore/fob/3/ path and executing it.
On January 29, 2026, Ivanti issued a security advisory regarding this vulnerability and later released a version that addresses it via the 12.8.0.0 update on May 7.
At AIWAF, we are responding to the “2336 / Ivanti EPMM Remote Code Execution” pattern added in the July 2026 pattern update.
Tags: CVE-2026-1281, CVE-2026-1340, Ivanti, Ivanti Endpoint Manager Mobile, Ivanti EPMM, Remote Code Execution, Command Injection
---
1. Overview
Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) is a UEM (Unified Endpoint Management)/MDM solution that provides unified management and policy enforcement for enterprise mobile devices, such as iOS and Android devices. It offers app deployment, content management, and enterprise resource access control features and is widely used in large organizations.
This report summarizes the analysis of the vulnerabilities identified in this system: Ivanti EPMM Pre-Auth RCE: CVE-2026-1281 & CVE-2026-1340.
2. Attack Type
This vulnerability is a command injection vulnerability that occurs because the Apache RewriteMap directive, used for mobile app deployment in Ivanti EPMM, passes parameter values from an unauthenticated HTTP endpoint directly to a server-side Bash script (/mi/bin/map-appstore-url, /mi/bin/map-aft-store-url) without authentication, and the script fails to properly validate the received values, leading to a command injection vulnerability.
An attacker passes the values contained in the URL path under /mifs/c/appstore/fob/3/ directly as arguments to the Bash script on the server. By manipulating the value of the “h” parameter to take the form of “gPath[malicious OS command], and by setting the value of the `st` parameter to a length that satisfies the validation logic, an attacker can execute malicious commands without authentication.
CVE-2026-1281 occurs in endpoints and scripts related to the In-House Application deployment feature (appstore), while CVE-2026-1340 occurs in endpoints and scripts related to the Android File Transfer (aftstore) deployment feature.
Attack Request:
GET /mifs/c/appstore/fob/3/5/sha256:kid=1,st=theValue ,et=1337133713,h=gPath[`sleep 5`]/e2327851-1e09-4463-9b5a-b524bc71fc07.ipa Host: www.test.com GET /mifs/c/aftstore/fob/3/5/sha256:kid=1,st=theValue%20%20,et=1337133713,h=gPath%5B%60id%20%3E%20/mi/poc%60%5D/13371337-1337-1337-1337-133713371337.ipa HTTP/1.1 Host: www.test.com
---
3. Mitigation Measures
On January 29, 2026, Ivanti issued a security advisory regarding these vulnerabilities and released interim security patches for each version. Subsequently, on May 7, they released version 12.8.0.0, which resolves these vulnerabilities.
Our AIWAF is addressing this vulnerability using the “2336 / Ivanti EPMM Remote Code Execution” pattern, which was added in the July 2026 pattern update.
---
4. Conclusion
Ivanti EPMM is a solution widely used by many large enterprises and organizations for mobile device management (MDM/UEM). Regarding the CVE-2026-1281 & CVE-2026-1340 vulnerabilities, detailed information and proof-of-concept (PoC) code have already been disclosed, and attack cases have been confirmed via the CISA KEV; therefore, customers using this system must promptly apply the relevant security patches and update to version 12.8.0.0 or higher.
Our TA team is actively monitoring vulnerabilities in Ivanti products and plans to respond promptly to any related vulnerabilities discovered in the future.
---
