The most serious of the three flaws Ivanti disclosed on August 11 needs no exploit chain and no clever payload. It needs a listening position. Ivanti Endpoint Manager sends the credentials it uses to reach an external SQL database in the clear, so anyone able to sit between the two can read them straight off the wire.
That is CVE-2026-18129, in EPM Core, and it affects every version up to and including 2024 SU6. Exploiting it requires neither authentication nor any action from a user, which means the barrier is network position rather than privilege. The exposed case is a flat internal network, where a foothold on one segment can see traffic belonging to many others. All three flaws are fixed in EPM 2024 SU7. Ivanti rates all three high severity, and the advisory carries a numeric CVSS score for only one of them, so treat Ivanti's own bulletin as the authority on the other two.
Endpoint Manager is the software many organizations use to inventory, patch and watch their laptops and servers. That places it in the small set of tools that, by design, can reach almost every machine in the estate.
The watchdog that can be switched off
CVE-2026-18125 is an out-of-bounds read in the EPM Agent, the piece that runs on each managed machine, and it carries a CVSS score of 7.5. A remote attacker with no credentials can send crafted input that crashes the agent service. There is no code execution, which is what makes this class of bug easy to leave for later, but the consequence is that administrators stop seeing the machine. Patch state, alerts and inventory go stale on an endpoint that is still running perfectly well.
Audit trails that can be rewritten
CVE-2026-18127 needs an authenticated account, but only a low-privileged one. It lets that account manipulate filenames and gain write access to the Amazon S3 bucket holding EPM's session recordings, so recordings can be altered, overwritten or planted. Session recordings are evidence, and a flaw that lets an ordinary user edit them is an integrity problem for anyone who would reach for those recordings during an investigation.
Upgrade to 2024 SU7, and encrypt the SQL link
Upgrade affected deployments to EPM 2024 SU7 through the Ivanti License System, starting with any that use an external SQL database or S3-backed session recording storage, since those are the two configurations these bugs actually reach. Put TLS on the connection between EPM and its database, segment the network around EPM infrastructure, and cut S3 write permissions back to the accounts that genuinely need them. Ivanti says it has seen no evidence of exploitation before disclosure, and reports that the flaws came through its responsible disclosure program, with an outside researcher credited for CVE-2026-18125. Full detail is in the advisory and in Ivanti's own security bulletin.
No indicators of compromise have been published, so detection is behavioral: unexpected EPM Agent crashes or restarts, unauthorized writes to the session-recording bucket, changes to recording files, and SQL authentication from somewhere it should not be coming from.
None of the three is a remote code execution bug, which is precisely why they will slide down the queue. It is worth remembering that Ivanti products have a poor record once details become public, as they did when a public exploit for Ivanti Sentry was followed by attacks in the wild. A stolen database credential does not announce itself on the day it is taken.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.