Ivanti EPM Update Patches Remotely Exploitable Flaws

Summary

Ivanti has released security updates for its Endpoint Manager (EPM) and Neurons for MDM products, patching several high-severity vulnerabilities. Two of these, CVE-2026-18129 and CVE-2026-18125, allow for remote, unauthenticated exploitation, potentially leading to credential leakage or service crashes. A third vulnerability, CVE-2026-18127, enables remote attackers to control filenames and gain write access to S3 buckets. Ivanti Neurons for MDM also received a fix for a medium-severity command-injection flaw.

Full text

Enterprise software company Ivanti on Tuesday announced patches for four vulnerabilities in Endpoint Manager (EPM) and Neurons for MDM. The EPM update addresses three high-severity bugs, including two that could be exploited by remote, unauthenticated attackers. Tracked as CVE-2026-18129, the first is described as a cleartext transmission of sensitive information issue that can be exploited by an attacker in a man-in-the-middle (MitM) position to leak credentials for external SQL connections. The second, CVE-2026-18125, is an out-of-bounds read flaw in the EPM agent that can be triggered to crash an agent service. Both security defects were resolved in EPM version 2024 SU7, which also patches CVE-2026-18127, a high-severity input validation weakness that allows remote attackers to control filenames. An authenticated threat actor could exploit the flaw to gain full write control over an S3 bucket configured for session recording storage.Advertisement. Scroll to continue reading. “We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure,” Ivanti said. Ivanti Neurons for MDM received fixes for a single medium-severity command-injection vulnerability that could be exploited remotely to disclose sensitive information. The flaw was patched in version R124 of the cloud-based SaaS platform in late June and requires no customer action. According to Ivanti, the issue “did not meet the criteria for reserving a CVE number” and there is no evidence that it has been exploited in the wild. Ivanti says no other products are affected by these vulnerabilities. Additional information can be found in the company’s August 2026 security update announcement. Related: SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform Related: Cisco Patches Firewall Zero-Day Exploited for DoS Attacks Related: SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities Related: August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire SAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesCisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents BadMetabase Patches Vulnerability Exploited as Zero-DayCISA Urges Immediate Patching of Exploited Progress LoadMaster VulnerabilityCorporate Data Stolen in Levi Strauss CyberattackVishing Extortion Group UNC6671 Rebrands After Making MillionsMicrosoft, Apple Release Fresh Security Updates Latest News Over 2,500 Organizations Impacted by LiteLLM Supply Chain AttackFresh Windows Zero-Day Exploited in North Korean CyberattacksICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix ContactSonicWall Patches Critical Vulnerabilities in Discontinued GMS PlatformCisco Patches Firewall Zero-Day Exploited for DoS AttacksAugust 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-DayAdobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic FlawsZoom Patches Zero-Click Code Execution Vulnerability Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-18129
• cve — CVE-2026-18125
• cve — CVE-2026-18127

Entities