CVE-2026-1340 describes a code injection vulnerability in Ivanti Endpoint Manager Mobile that enables unauthenticated remote code execution. The weakness stems from improper control over code generation, allowing attackers to inject and execute arbitrary code without authentication. The vulnerability is rated critical with a CVSS score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on affected systems without authentication, potentially leading to full system compromise, data loss, or service disruption. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability of the affected product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor Ivanti's security advisories for updates. Given the lack of patch or workaround information, applying network-level protections such as restricting access to the affected service may help reduce exposure.