Loading story…
Ivanti disclosed three high-severity vulnerabilities in Ivanti Endpoint Manager (EPM) affecting all versions up to and including 2024 SU6, and directed customers to upgrade to EPM 2024 SU7. The issues include CVE-2026-18125, which allows an unauthenticated remote attacker to crash the EPM Agent service; CVE-2026-18127, which allows an authenticated attacker to gain write access to an Amazon S3 bucket used for session recording storage; and CVE-2026-18129, which allows a man-in-the-middle attacker to intercept cleartext credentials used for external SQL database connections.
Public vulnerability records describe CVE-2026-18129 as a cleartext transmission flaw in the EPM Core component before 2024 SU7, with high potential impact despite requiring a man-in-the-middle position. Ivanti said fixes are included in 2024 SU7 and reported no evidence of active exploitation before disclosure, while the Canadian Centre for Cyber Security issued advisory AV26-805 urging organizations to review Ivanti’s guidance and apply updates. Ivanti also recommended prioritizing patching for deployments using external SQL databases or S3-backed session logs and monitoring for agent crashes, unauthorized S3 writes, and unusual SQL authentication activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-12, CSIRT Italia published alert AL01/260812/CSIRT-ITA about Ivanti's August 2026 security update for Endpoint Manager. The alert warned that versions earlier than 2024 SU7 are affected, highlighted CVE-2026-18129, CVE-2026-18127, and CVE-2026-18125, and recommended applying Ivanti's updates.
On August 11, 2026, the Canadian Centre for Cyber Security published notice AV26-805 warning that Ivanti Endpoint Manager versions prior to or equal to 2024 SU6 are affected by vulnerabilities. The notice directed users and administrators to review Ivanti's advisory and apply updates when available.
On August 11, 2026, a CISA Coordinator SSVC assessment was added to the CVE-2026-18129 record. The assessment stated exploitation was none, automatable was no, and technical impact was total.
On August 11, 2026, the CVE record for CVE-2026-18129 was newly received and later modified, documenting a cleartext transmission flaw in Ivanti Endpoint Manager Core before version 2024 SU7. The entry linked to Ivanti's advisory and reflected that version 2024 SU7 is unaffected.
On August 11, 2026, Ivanti issued a security advisory disclosing three high-severity vulnerabilities in Ivanti Endpoint Manager affecting versions up to and including 2024 SU6. Ivanti stated the issues were fixed in EPM 2024 SU7, made that release available through the Ivanti License System, and said it had no evidence of active exploitation before disclosure.
In late June 2026, Ivanti patched a medium-severity remote command-injection vulnerability in the cloud-based Neurons for MDM platform in version R124. Ivanti said the issue could disclose sensitive information, did not receive a CVE, and showed no evidence of in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcesecurityweek.com
Open sourceacn.gov.it
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcehub.ivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti released security updates for *Endpoint Manager (EPM)* to fix two vulnerabilities affecting **EPM 2024 SU4 SR1 and earlier**: **CVE-2026-1603** (CVSS 8.6) and **CVE-2026-1602** (CVSS 6.5). CVE-2026-1603 is an **authentication bypass** that can be exploited by a **remote, unauthenticated** attacker to access/leak specific **stored credential data**, creating a high-risk path to credential exposure and follow-on compromise in environments where EPM operates with elevated privileges across endpoints. CVE-2026-1602 is a **SQL injection** issue that requires **authentication** and can allow a remote authenticated attacker to **read arbitrary data from the EPM database**, driving confidentiality risk (data leakage) rather than integrity/availability impact. The fixed release is **EPM 2024 SU5**, and the update also addresses **11 medium-severity vulnerabilities** previously disclosed in October 2025; organizations running affected versions were advised to patch immediately due to the platform’s central role in enterprise endpoint administration.
Jun 29, 2026
Ivanti has disclosed a critical vulnerability (CVE-2025-10573) in its Endpoint Manager (EPM) software, which allows unauthenticated remote attackers to execute arbitrary JavaScript code via a stored cross-site scripting (XSS) attack. The flaw enables attackers to register fake managed endpoints to the EPM server, thereby injecting malicious JavaScript into the administrator web dashboard. When an administrator interacts with the compromised dashboard, the attacker can hijack the session and potentially gain full control over the EPM environment. Ivanti has released a patch (EPM 2024 SU4 SR1) to address this issue and strongly urges customers to update, especially since hundreds of EPM instances are exposed to the internet, increasing the risk of exploitation. The vulnerability, assigned a CVSS score of 9.6, affects EPM versions 2024 SU4 and below. Security researchers at Rapid7, who discovered and reported the flaw, emphasize the urgency of patching due to the unauthenticated nature of the attack vector. Ivanti EPM is widely used for endpoint management, remote administration, and compliance, making it a high-value target for attackers. In addition to CVE-2025-10573, Ivanti has also released fixes for three other high-severity vulnerabilities in the same update cycle. Security teams are advised to apply the latest patches immediately and review the exposure of EPM instances to the internet to mitigate the risk of compromise.
Jun 29, 2026
**CISA added Ivanti Endpoint Manager (EPM) vulnerability `CVE-2026-1603` to the Known Exploited Vulnerabilities (KEV) catalog**, warning it is being actively exploited and directing U.S. federal agencies to remediate within mandated timelines. The flaw is described as an **authentication bypass** (CWE-288) that allows **remote, unauthenticated** attackers to access and **steal sensitive stored credential data**, creating elevated risk because EPM is commonly used as a central platform for managing large endpoint fleets. Ivanti addressed `CVE-2026-1603` in **Ivanti EPM 2024 SU5**; reporting indicates the same release also fixed an **SQL injection** issue that could allow authenticated attackers to read arbitrary database data. Public reporting notes CISA did not provide detailed exploitation telemetry, and Ivanti stated it was not aware of customer exploitation prior to public disclosure; external monitoring cited **700+ internet-facing EPM instances** observed by Shadowserver, underscoring potential exposure where systems remain unpatched.
Jun 29, 2026