Ivanti EPM Vulnerability Advisory: CVE-2026-18125, 18127, 18129 (Remote Code Execution, Info Disclosure)

Vulnerability Overview Ivanti released updates for Ivanti Endpoint Manager (EPM) addressing three high-severity vulnerabilities. These are: 1. CVE-2026-18125: A buffer over-read vulnerability exists in the Agent component of Ivanti Endpoint Manager. In versions prior to 2024 SU7, this allows remote unauthenticated attackers to crash the agent service. 2. CVE-2026-18127: An external control threat exists in the Core component of Ivanti Endpoint Manager. In versions prior to 2024 SU7, this allows remote authenticated attackers to gain full control over more than 53 buckets configured as session log storage. 3. CVE-2026-18129: Sensitive information is transmitted in plaintext in the Core component of Ivanti Endpoint Manager. In versions prior to 2024 SU7, this allows remote unauthenticated attackers positioned for a man-in-the-middle (MITM) attack to leak credentials used for external SQL connections. Affected Versions Affected versions: Ivanti Endpoint Manager (EPM) 2024 SU6 and earlier. Fixed version: 2024 SU7. Resolution Customers can resolve these vulnerabilities by upgrading to Ivanti EPM 2024 SU7. This version is available in ILS. Additional Information Release date: August 11, 2026 Last modified date: August 11, 2026 Acknowledgments: Ivanti thanks Hieu Tran Nam (kana101) for reporting CVE-2026-18125. FAQ Is there any active exploitation of these vulnerabilities? - Prior to public disclosure, we were not aware of any customers being impacted by exploitation of these vulnerabilities. These vulnerabilities were disclosed through our responsible disclosure program. How can I determine if I have been compromised? - Currently, there are no known public exploits for these vulnerabilities; therefore, a list of indicators of compromise (IOCs) cannot be provided. What should I do if I need assistance? - If you have further questions after reviewing this information, you can log a case or request a call by contacting Ivanti Innovators Hub. Article Number Article Number: 000108278 Article Promotion Level: Normal Disclaimer Ivanti is committed to ensuring the security and integrity of its enterprise software products. We recognize the critical role played by security researchers, ethical hackers, and the broader security community in identifying and reporting vulnerabilities. Visit HERE to learn more about our vulnerability disclosure policy.

Goal Reached Thanks to every supporter — we hit 100%!

Ivanti EPM Vulnerability Advisory: CVE-2026-18125, 18127, 18129 (Remote Code Execution, Info Disclosure)