Preliminary research

Someone Knows Bash Far Too Well: Ivanti EPMM Pre-Auth RCEs (CVE-2026-1281 and CVE-2026-1340)

Piotr Bazydlo, McCaulay Hudson, Sina Kheirkhah, Sonny, Aliz Hammond and Jake Knott · watchTowr Labs · 30 January 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Follows attacker-controlled HTTP values through Apache RewriteMap into Ivanti EPMM Bash helper scripts. Bash arithmetic expansion turns the untrusted values into command execution, producing two pre-authentication RCE paths and practical detection guidance.

Record

Researcher

Piotr Bazydlo, McCaulay Hudson, Sina Kheirkhah, Sonny, Aliz Hammond and Jake Knott

Published by

watchTowr Labs

Date

30 January 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• bash
• apache
• command-injection
• reverse-proxy
• attack-chain
• rce
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Piotr Bazydlo, McCaulay Hudson, Sina Kheirkhah, Sonny, Aliz Hammond and Jake Knott, first published at the original source. Preserved copies are kept so the citation survives its host.