{"uuid": "f2f9c354-7f8c-4702-9f91-53aac895eaad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-1281", "type": "exploited", "source": "https://t.me/CyberDispatch/716", "content": "417 exploitation sessions from 8 unique source IP addresses between February 1 and 9, 2026. An estimated 346 exploitation sessions have originated from 193.24.123[.]42, accounting for 83% of all attempts.\n\nThe malicious activity is designed to exploit CVE-2026-1281 (CVSS scores: 9.8), one of the two critical security vulnerabilities in EPMM, along with CVE-2026-1340 that could be exploited by an attacker to achieve unauthenticated remote code execution. Late last month, Ivanti acknowledged it's aware of a \"very limited number of customers\" who were impacted following the zero-day exploitation of the issues.", "creation_timestamp": "2026-08-31T00:00:13.066524Z"}