CVE-2026-18128 in ivanti endpoint manager
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.
Affected software: ivanti endpoint manager
Scores
- CVSS: 6.8 (medium)
- EPSS: 0.44% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2026-11-10
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Ivanti Endpoint Manager to 2024 SU8 (CVE-2026-121653, CVE-2026-18128)
Patch or upgrade. EPM 2024 SU8 fixes an unauthenticated SQL injection in the EPM Core server that leads to remote code execution, and cleartext agent traffic that a man-in-the-middle can read and change. The Core server manages every endpoint, so a takeover reaches the whole estate.
Applies to: Ivanti Endpoint Manager (EPM) Core server and agents before 2024 SU8
- Open the Ivanti EPM November 2026 security advisory and check which Core server versions it lists as affected.
- On the Core server, check the installed version in the EPM console under About (anything before 2024 SU8 is affected).
- Take a backup or snapshot of the Core server and its database.
- Download and install EPM 2024 SU8 from the Ivanti License and Download portal on the Core server, then reboot when asked.
- Update the EPM agents to the SU8 agent version so agent traffic is protected (CVE-2026-18128).
- Until the update is in, make sure the Core server web interface is not reachable from the internet and only accepts connections from managed networks and admin workstations.
- After patching, review the Core server's IIS logs and database for unexpected requests or new admin accounts from the period before the update.
Sources:
In the news
1 publication wrote about this CVE in the last 14 days, most recently on 2026-11-13.
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.