Ivanti has disclosed three high-severity vulnerabilities in Ivanti Endpoint Manager (EPM), affecting all versions through 2024 SU6. Published on August 11, 2026, the advisory warns that the flaws could allow remote attackers to disrupt endpoint management, manipulate cloud-based session recordings, or intercept sensitive database credentials. Ivanti has addressed all three vulnerabilities in EPM 2024 SU7, which organizations are strongly advised to deploy without delay, particularly those using external SQL databases or Amazon S3-backed session recording storage.

The first vulnerability, CVE-2026-18125, is an out-of-bounds read (CWE-125) affecting the EPM Agent and carries a CVSS score of 7.5. A remote, unauthenticated attacker can send specially crafted input to crash the agent service on managed endpoints without requiring credentials or user interaction. Although the flaw does not provide code execution, successful exploitation could disrupt endpoint management and potentially leave administrators unable to properly monitor or manage affected systems. The second flaw, CVE-2026-18127, is an external control of filename vulnerability (CWE-73) with a CVSS score of high. An authenticated attacker with low-level privileges could manipulate filenames and gain write control over an Amazon S3 bucket used for session recordings, allowing them to alter, overwrite, or plant files and potentially compromise the integrity of audit records.

The most severe issue, CVE-2026-18129, has a CVSS score of high and involves cleartext transmission of sensitive information (CWE-295) within EPM Core. An attacker positioned as a Man-in-the-Middle (MitM) could intercept unencrypted communications and obtain credentials used for external SQL database connections. Because exploitation does not require authentication or user interaction, organizations with insufficient network segmentation face increased exposure. Ivanti stated that there is no evidence of active exploitation before disclosure, and the vulnerabilities were discovered through its responsible disclosure program; researcher was credited for reporting CVE-2026-18125.

Organizations should prioritize upgrading affected EPM deployments to 2024 SU7 through the Ivanti License System and strengthen network segmentation around EPM infrastructure, SQL databases, and cloud storage. Until patches are deployed, security teams should monitor for unexpected EPM Agent crashes, unauthorized or unusual S3 bucket writes, unexpected changes to session-recording files, and abnormal SQL authentication activity. Ivanti has not provided public indicators of compromise (IoCs) for these vulnerabilities, so behavioral and endpoint telemetry are particularly important. Given the potential impact on endpoint availability, cloud-stored audit data, and database credentials, organizations should treat the update as a high-priority patching activity and ensure that remediation is tested and rolled out across production environments.