It’s one month into 2026, and vulnerability disclosures have already started piling in at record-breaking rates. As of today, around 26,000 CVEs have been assigned, with around 10,000 of those already being published on NVD, the national vulnerability database. One of those vulnerabilities is CVE-2026-1281, a remote code execution exploit in Invanti Endpoint Manager Mobile (EPMM).
Using data provided by the CrowdSec Network, we can now confirm that this vulnerability is being actively exploited in the wild, resulting in its inclusion in the CISA KEV catalog. Security teams must now act to patch the vulnerable systems as soon as possible.
Key findings
Active exploitation of CVE-2026-1281 was observed starting on February 4th, 2026, and the vulnerability has been added to CISA KEV.
CVE-2026-1281 originates from an issue in a Bash handler of a specific EPMM endpoint. It allows for almost immediate remote code execution.
The campaign targeting CVE-2026-1281 originates from a few but potent attackers, making pre-emptive security a powerful protection mechanism.
How does CVE-2026-1281 work ?
CVE-2026-1281 is a pre-authentication Remote Code Execution (RCE) vulnerability discovered by WatchTowr Labs. The vulnerability originates from the web server configuration, which routes specific URL requests to a Bash script for processing. Bash is a very popular scripting language, and its associated shell is the default for both MacOS and most Linux systems. The vulnerability appears because requests to /mifs/c/appstore/fob/ are handled by a script named map-appstore-url. This script fails to properly sanitize user inputs before using them in a Bash context. Attackers can therefore inject malicious payloads via URL parameters, causing Bash to execute them as commands when it evaluates the given requests.
...
