Ivanti dropped an urgent advisory this week: a high-severity remote code execution flaw in Endpoint Manager Mobile is being exploited in zero-day attacks. There’s no patch window here, no theoretical risk you can defer to next quarter’s maintenance cycle. Attackers are already working this flaw against live EPMM deployments right now.

EPMM is the software that manages every corporate phone and tablet in your environment. It pushes configurations, certificates, VPN profiles, and security policies to your entire mobile workforce. Compromising it hands an attacker a master key to that fleet. From a cybersecurity standpoint, your MDM server might be the single highest-value target in your network that your security team consistently under-monitors.

That’s the immediate problem. The broader problem is that mobile endpoint management is becoming a preferred attack vector for threats at every level of sophistication, from nation-states to criminal scam networks operating tens of thousands of domains simultaneously.

What Attackers Get When MDM Falls

An MDM platform is a fleet commander. It enrolls devices, enforces passcode policies, distributes app packages, manages VPN certificates, and can remotely wipe hardware across your entire organization. Compromise your EPMM instance and you inherit that entire capability set.

That translates to pushing a malicious configuration profile to every managed device simultaneously, revoking legitimate certificates and replacing them with attacker-controlled ones, silently installing applications, or redirecting corporate traffic through hostile infrastructure. Depending on your environment, they may also walk away with device inventory data, user identity records, and geo-location history for your entire mobile workforce.

Traditional incident response playbooks weren’t designed for this scenario. A single compromised endpoint gets isolated. A compromised MDM server means every device that checked in after the breach should be treated as suspect until you’ve verified server integrity. That’s a different scale of problem, and most teams haven’t stress-tested their playbooks against it.

Ivanti’s history adds painful context. Their Connect Secure, Neurons, and Gateway products have each generated serious CVEs over the past two years. Security teams running Ivanti infrastructure have been on a near-continuous patch cycle, which breeds exactly the kind of fatigue that delays responses when the next advisory lands. Attackers count on that delay.

Mobile Endpoints Are the 2026 Cybersecurity Target

This EPMM zero-day didn’t land in isolation. Security researchers at Malwarebytes uncovered a criminal network this week operating more than 15,500 domains, all pushing AI-branded investment scams at carefully pre-screened targets. The scale is staggering, but the evasion technique is what makes it genuinely dangerous for enterprise security teams.

The campaign uses Keitaro, a legitimate ad-tracking platform, to filter who actually sees the malicious content. Security scanners, automated crawlers, and researchers get routed to clean pages. Pre-qualified targets, screened by behavioral and demographic signals, see the scam infrastructure. Your threat detection tools are looking at a blank wall, because the malicious content only materializes for humans Keitaro has already decided are worth targeting.

Your mobile workforce is squarely in the crosshairs. AI investment scams are engineered for quick decisions made on phones, often after hours, when corporate security controls feel furthest away. A 15,500-domain campaign is also a reminder that scale itself is a cyber security evasion technique. Conventional blocklists and IP reputation databases can’t process infrastructure at that volume fast enough to be useful.

Meanwhile, Palo Alto Networks disclosed this week that a zero-day in its firewall products is being exploited in a campaign with hallmarks of Chinese state-sponsored intrusion. Nation-states are hitting network perimeter equipment. Criminal networks are running massive scam campaigns targeting mobile users. Both are active at the same time.

Defense in depth has real operational meaning in this environment. MDM hygiene, perimeter security, threat-protection controls, and user awareness all need to function together, because sophisticated attackers are probing all of them in parallel.

Harden Your MDM Stack Before Exposure Becomes Breach

Start with the obvious: patch Ivanti EPMM now. Active zero-day exploitation means every hour of delay is measurable risk. If emergency patching isn’t immediately feasible, restrict EPMM management interface access to trusted internal IP ranges using firewall ACLs. No MDM admin console belongs on the public internet without tight network controls around it.

Work through these steps for your MDM environment:

• Audit device enrollment certificates issued in the last 90 days for any unexpected entries.
• Review MDM policy push logs for configuration deployments you didn’t authorize.
• Verify that all admin accounts on the EPMM server require phishing-resistant MFA.
• Confirm the MDM management plane is network-segmented from general corporate traffic.
• Flag every device that checked in after your last verified-clean server state for additional scrutiny.

If you have reason to suspect compromise has already occurred, treat the entire managed fleet as potentially hostile until MDM server integrity is established. Incident response at this scale means assuming the worst about every device that touched the compromised server, not just isolating one endpoint.

For the scam network threat, DNS filtering that blocks newly-registered domains at scale is more durable than manually-maintained blocklists. A campaign spanning 15,500 domains will exhaust any human-curated list within days. Behavioral threat detection that flags unusual authentication attempts, unexpected geolocations, or credential-stuffing patterns catches what signature-based tools miss entirely.

On the brute-force front, if you’re running automated IP blocking tools like IPBan Pro, verify that your EPMM admin portal login is explicitly covered in your configuration. MDM admin interfaces get excluded from brute-force protection setups because they’re assumed to be internal-only, and that assumption is increasingly outdated as remote management requirements expand across distributed workforces.

Security hardening for mobile management infrastructure rarely makes the priority list until an active zero-day forces the issue. One just did. That’s enough reason to move it to the top of the queue this week.

Sources

• Ivanti warns of new EPMM flaw exploited in zero-day attacks
• Massive AI investment scam network spans 15,500 domains
• Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking