Exploitation of Ivanti EPMM Vulnerabilities

On January 29th, 2026, the Dutch National Cyber Security Centre (NCSC) discovered active exploitation of two unspecified vulnerabilities within Ivanti Endpoint Manager Mobile (EPMM) systems. The report indicates ongoing exploitation but lacks specific details regarding the threat actor, affected versions, or the precise nature of the vulnerabilities beyond their presence in Ivanti EPMM. This activity poses a significant risk to organizations utilizing Ivanti EPMM for mobile device management, potentially leading to unauthorized access, data breaches, or system compromise. Defenders should prioritize patching and monitoring of Ivanti EPMM deployments.

Attack Chain

1. Initial access is gained via exploitation of an unspecified vulnerability in the Ivanti EPMM system, likely through a network-based attack.
2. The attacker executes arbitrary code on the vulnerable EPMM server.
3. The attacker establishes a persistent foothold, potentially by creating new user accounts or modifying system configurations.
4. The attacker performs reconnaissance activities to map out the internal network and identify valuable targets.
5. The attacker escalates privileges to gain administrative control over the EPMM system and potentially other connected systems.
6. The attacker exfiltrates sensitive data from the EPMM system, including device configurations, user credentials, and potentially corporate data stored on managed devices.
7. The attacker may deploy malware to managed mobile devices via the compromised EPMM server.

Impact

Successful exploitation of Ivanti EPMM vulnerabilities can lead to a range of severe consequences. Organizations could experience data breaches, loss of sensitive information, and potential compromise of managed mobile devices. The lack of specific details in the report makes it difficult to quantify the exact number of victims or the specific sectors targeted. However, given the widespread use of MDM solutions like Ivanti EPMM, a successful attack could have a significant impact on businesses and government organizations alike.