Threat Research / TR-2026-01
Ivanti Endpoint Manager Mobile, formerly MobileIron Core, has been exploited in the wild every year since 2020. This analysis traces what changed across six years of campaigns, and why the interesting question is no longer whether you patched.
Consecutive years with exploited-in-the-wild vulnerabilities in Ivanti's mobile management line
Days from vendor disclosure to public exploit code, 2020 compared with January 2026
Separate zero-day exploitation events against EPMM in the first five months of 2026 alone
Ivanti vulnerabilities flagged by CISA as exploited since late 2021, across the product line
01 · Executive summary
Five findings. Each one is a change in attacker behaviour that shifts what a defender has to do, not merely another advisory to file.
F-01
In 2020, proof-of-concept code for the MobileIron RCE appeared roughly three months after the fix shipped. In January 2026, working exploit code was public within about a day of disclosure, and mass automated exploitation followed within a week. Patch cycles measured in maintenance windows no longer fit the threat.
F-02
Every major EPMM event since 2023 was a zero-day. In the 2023 campaign against Norwegian government networks, exploitation ran from at least April to July before the vendor advisory existed. By the time you learn of the vulnerability, the relevant question is already forensic.
F-03
The February 2026 campaign seeded dormant implants that stay silent until a specific trigger is supplied, banking access for later sale or handoff. Patching removes the door. It does not remove a tenant who is already inside and holding still.
F-04
The May 2026 zero-day requires administrative authentication. The vendor's own guidance is that organisations which rotated admin credentials after the January incidents face significantly reduced risk. Unremediated compromise compounds: one event's stolen credentials become the next event's precondition.
F-05
No reliable indicators of compromise were published for the May 2026 zero-day. Where the vendor cannot supply IOCs and the implant is designed to be quiet, indicator-matching produces silence rather than assurance. Detection has to be written against behaviour, and it has to be tested.
02 · Context
A mobile device management platform is not simply another server. It is the room where the building's master keys are cut. It holds the device inventory, the enrolment certificates, the policy engine that can push configuration to every managed handset, and, in most deployments, a live integration into the corporate directory.
National authorities said as much early. The UK's NCSC noted in 2020 that MDM systems let administrators manage an organisation's mobile estate from a central server, which is precisely what makes them valuable to attackers. CISA and Norway's NCSC repeated the point in 2023: MDM systems provide elevated access to thousands of mobile devices.
Three properties compound the risk. The appliance is usually internet-facing by design, because enrolled devices must reach it from anywhere. It is usually owned by an IT operations team rather than a security team, so it sits outside the estate's best-instrumented zone. And it is usually trusted implicitly by everything downstream of it, so a foothold there converts cleanly into device access, credential access, and lateral movement.
The blast radius
Device inventory
Every enrolled handset, its owner and its configuration.
Enrolment certificates
The material that decides which devices count as trusted.
Policy engine
Push configuration to the entire managed fleet.
Directory integration
In most deployments, a live path into corporate identity.
03 · The record
Each entry is a documented exploitation event or a vulnerability that materially widened the attack surface.
June 2020 · patched, exploited from September
Patched in June; a public proof of concept followed in September. The UK NCSC then warned that both nation-state APT groups and criminal actors were actively attempting to exploit it against UK organisations, naming healthcare, local government, logistics and legal as targeted sectors. The US NSA placed the same CVE on its October 2020 list of vulnerabilities exploited by Chinese state-sponsored actors, and CISA observed it chained with the Netlogon flaw CVE-2020-1472 in a single intrusion.
24 July 2023 · zero-day, exploited from April
Exploited as a zero-day from at least April through July 2023 to collect information from Norwegian organisations and to compromise a Norwegian government network; a dozen ministries were affected. Unauthenticated access to specific API paths yielded user PII, device details, configuration changes and the ability to create administrative accounts. Actors proxied through compromised SOHO routers, ran arbitrary LDAP queries, enumerated administrators, altered EPMM configuration, reviewed audit logs and deleted log entries, then tunnelled onward through Ivanti Sentry.
28 July 2023 · chained
Allows an actor holding EPMM administrator privileges to write arbitrary files, typically webshells, with the privileges of the web application server. Chaining it behind the authentication bypass converts unauthenticated access into durable code execution.
2 August 2023 · patch bypass
Discovered by Rapid7 while investigating the first flaw and effectively a bypass of it. Initially believed to affect only end-of-life MobileIron Core 11.2 and earlier; the vendor subsequently confirmed EPMM 11.10, 11.9 and 11.8 and MobileIron Core 11.7 and below were also exposed depending on configuration. CISA added it to the Known Exploited Vulnerabilities catalogue in January 2024.
21 August 2023 · adjacent product
An unauthenticated attacker reaching the configuration portal on port 8443 could make changes to the server and underlying operating system as root. A proof of concept was published two days after disclosure, and exploitation was confirmed. Sentry supports EPMM, which is why an MDM compromise assessment that stops at the EPMM appliance is scoped too narrowly.
13 May 2025 · exploited from 15 May
Individually rated medium and high (5.3 and 7.2) and residing in open-source libraries integrated into EPMM; chained, they yield unauthenticated remote code execution. EclecticIQ attributed exploitation with high confidence to the China-nexus espionage cluster UNC5221, beginning two days after disclosure. Targets spanned healthcare, telecommunications, aviation, municipal government, finance and defence across Europe, North America and Asia-Pacific. Operators reached the /mifs/rs/api/v2/ endpoint, dropped KrustyLoader from a compromised cloud bucket and followed with Sliver, specifically seeking files holding cleartext database credentials.
29 January 2026 · zero-day
Code injection in the In-House Application Distribution and Android File Transfer Configuration features. The underlying defect sits in legacy shell scripts invoked by Apache rewrite rules, exploitable through shell arithmetic expansion. No credentials, no user interaction. Public exploit code appeared within about a day. CISA set a three-day federal remediation deadline. Shadowserver tracked roughly 1,600 exposed instances at the peak of the activity; Unit 42 telemetry counted over 4,400 EPMM instances overall.
February 2026 · post-exploitation
Two waves. First the predictable one: automated scanning, commodity webshells, cryptominers, and an open-source monitoring agent used for persistence. Then a quieter campaign from 4 February that seeded JSP shells which activate only on a specific trigger parameter: a foothold taken, then left alone, consistent with initial-access-broker tradecraft. Incident response work on a February case confirmed data exfiltration from an EPMM host, with several unrelated actors exploiting the same target opportunistically. National authorities in the Netherlands advised organisations running EPMM to adopt an assume-breach posture; Dutch judicial bodies were among those affected.
7 May 2026 · zero-day
Improper input validation permitting remote code execution by an authenticated administrator; confirmed exploited against a limited number of customers and added to KEV with a three-day federal deadline. No reliable indicators of compromise were published. The vendor's guidance ties the risk directly to January: organisations that rotated administrative credentials after the earlier compromises are substantially less exposed.
7 May 2026 · same cycle
The same patch cycle addressed access-control and certificate-validation defects that move the exposure past code execution and into device identity: administrative access from an authenticated user, impersonation of registered Sentry hosts to obtain valid CA-signed client certificates, unauthenticated invocation of arbitrary methods, and unauthenticated device enrolment. Fixed releases: 12.6.1.1, 12.7.0.1 and 12.8.0.1.
The compression
Bars right of the line are days of warning. Bars left of it are days the attacker was already inside before anyone published a fix.
Read it this way: patching stopped being a race you could win in 2023, and has not been one since.
04 · Regional lens
Exposure data for these campaigns is concentrated in Europe and North America, and it would be easy for a regional CISO to read that as distance. It is not. Internet-facing MDM is deployed the same way everywhere, exploitation in the 2026 waves was largely automated and indiscriminate, and the campaign that mattered most in February was opportunistic rather than targeted.
What is different regionally is the regulatory consequence of finding out late.
For banks under the Central Bank of Egypt's framework, and for organisations across the GCC operating under equivalent supervisory expectations, the governance question is narrower and harder than the technical one: on what evidence does the board conclude that the exposure window was not used? A patch record answers a different question.
Part two
Everything above explains the problem. The rest of the report is what you do about it, written for the two people who have to act: the engineer who has to hunt, and the executive who has to answer for the result.
Eight hunt behaviours, ATT&CK-mapped
Vendor-agnostic and applicable whether or not you have patched, including the three that matter most where no indicators of compromise exist.
The complete CVE ledger
Fourteen entries, 2020 to 2026, with access required and confirmed exploitation status side by side.
Five questions for your MDM owner
Board-ready, answerable in a single meeting, and designed to surface the gap between "patched" and "clean."
Method, sources and scope notes
Every claim traceable to a vendor advisory, national authority or named research team.
