Ivanti EPM: Update patches three critical security vulnerabilities

Ivanti has released updates that close several security vulnerabilities in its Endpoint Manager (EPM) software, which the manufacturer considers to be of high threat level. Attackers can steal credentials, manipulate cloud storage, or crash the agent service.

In a security advisory, Ivanti developers warn that sensitive information is transmitted in plain text from the Ivanti EPM Core. Attackers in a man-in-the-middle position can thus intercept credentials for external SQL connections (CVE-2026-18129, CVSS 8.1 , risk “ high ”). By submitting a carefully crafted file name, attackers can also gain full write access to S3 buckets used for storing session recordings in the EPM Core (CVE-2026-18127, CVSS 7.7 , risk “ high ”). A third vulnerability is based on potential read access outside of designated storage boundaries, which unauthenticated attackers from the network can provoke, causing the agent service to crash (CVE-2026-18125, CVSS 7.5 , risk “ high ”).

Ivanti does not go into further detail. However, the developers have fixed the errors in an updated software version. Ivanti EPM 2024 SU7 or newer is said to no longer exhibit the security vulnerabilities, the manufacturer promises. It is available for download in the Ivanti license system .

Ivanti further states that the company is not aware of any attacks on these vulnerabilities at customer sites so far. Therefore, Ivanti cannot provide any indications of potentially successful attacks that admins could use to research attack attempts. Nevertheless, IT managers should promptly download and install the updated software to minimize the potential attack surface for malicious actors.

Most recently, Ivanti had to fix vulnerabilities in Endpoint Manager in mid-May . They allowed, for example, the injection of SQL commands and privilege escalation in vulnerable systems.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.