CVE-2026-1340

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
IvantiEndpoint Manager Mobile—

References

Timeline

Published
Jan 29, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
Apr 8, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-134006.1Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The CVE-2026-134017.5XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never CVE-2026-134025.3The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they referencCVE-2026-134045.3The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publiCVE-2026-134056.6The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a filCVE-2026-134065.3The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy teCVE-2026-134075.4The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget bCVE-2026-134094.3The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after auCVE-2026-13419.3Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.CVE-2026-134108.2Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_vCVE-2026-134114.3Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated CVE-2026-134135.3The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-s
CVE-2026-1340: Critical severity, CVSS 9.8 | Vulnix