Federal cybersecurity authorities have expanded the Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04 to mandate emergency mitigation for an actively weaponized enterprise mobility management flaw. Unauthenticated remote adversaries transmit malformed API parameters to execute arbitrary operating system commands with root privileges across mobile device management servers.
The catalog update features Ivanti Endpoint Manager Mobile EPMM unauthenticated command injection flaw CVE-2026-105192 carrying a CVSS score of 9.8. Threat telemetry confirms state-backed threat actors actively weaponizing the defect to achieve initial access, extract device registration databases, and push rogue configuration profiles to managed enterprise mobile endpoints. Under Binding Operational Directive 26-04, federal civilian executive branch agencies face an emergency October 17 compliance deadline to apply vendor security updates.
Subverting central enterprise mobility management platforms compromises whole-fleet device boundaries. Because EPMM servers issue device certificates, push mobile application payloads, and manage corporate network access credentials, an unauthenticated server takeover permits threat actors to compromise enrolled mobile endpoints, intercept internal communications, and pivot into corporate networks.
– Apply official maintenance security updates published by Ivanti across all Endpoint Manager Mobile appliances immediately.
– Isolate EPMM web management interfaces behind zero trust access control proxies and enforce strict IP access control lists.
– Inspect EPMM system execution logs for anomalous shell processes spawned by web server daemons or unverified API calls.
– Audit enrolled mobile device inventories for unauthorized profile deployments or unverified administrative account additions.
Enterprise mobility management defense demands rapid patch execution and strict API control plane isolation to ensure mobile management infrastructure remains protected from unauthenticated command injection zero-days. #CodeDefence #Ivanti #EPMM #MobileSecurity #CISA #KEV #ZeroDay #RCE #AppSec
/
