SURIQ
An endpoint management server is one of the most valuable machines on any network. It holds credentials, reaches every host it manages, and keeps the record of what happened on them. On August 11, 2026, Ivanti published an advisory for its Endpoint Manager (EPM) that chips at all three of those things at once. One flaw exposes stored database passwords, one lets a low-privilege user rewrite the session recordings that stand in as an audit trail, and one lets an unauthenticated attacker knock the endpoint agents offline. All three are fixed in the 2024 SU7 release. None is reported exploited yet, but Ivanti gear has a short history between patch and attack, so the clock started when the advisory went live.
What Ivanti patched in the August 2026 Endpoint Manager advisory
Ivanti's August 2026 Endpoint Manager advisory fixes three high-severity flaws, all resolved in version 2024 SU7. They range from a credential exposure that needs a traffic-interception position, to an authenticated write-access bug over the session-recording store, to an unauthenticated flaw that crashes an agent service. Every version before SU7 is affected.
| CVE | Severity | What it is | What an attacker can do | Access needed |
|---|---|---|---|---|
| CVE-2026-18129 | CVSS 8.1 | Cleartext transmission in the core (improper certificate validation) | Read the credentials EPM uses for external SQL database connections | Network interception position, unauthenticated |
| CVE-2026-18127 | CVSS 7.7 | The core trusts an attacker-supplied storage filename | Gain full write control over the storage bucket that holds session recordings | Authenticated, low privilege |
| CVE-2026-18125 | CVSS 7.5 | Out-of-bounds read in the agent | Crash an agent service, stopping it from reporting | Unauthenticated |
The headline flaw is CVE-2026-18129, scored 8.1. EPM sends the credentials it uses for external SQL database connections in a form that an attacker who can intercept the traffic is able to read, which Ivanti classes as improper certificate validation. This is not a remote-from-anywhere bug: it needs a machine-in-the-middle position on the network path. On a flat internal segment, or anywhere an attacker already has a foothold, that position is not hard to reach.
CVE-2026-18127, scored 7.7, is the one worth sitting with. A low-privilege authenticated user can gain full write control over the storage bucket that holds EPM's session recordings. Read that plainly: the person who is supposed to be recorded can edit or delete the recording. An audit trail you can rewrite is not an audit trail.
CVE-2026-18125, scored 7.5, is an out-of-bounds read in the EPM agent that lets an unauthenticated attacker crash the agent service. There is no code execution here. But a crashed agent stops reporting, and an endpoint that stops reporting is an endpoint you are no longer watching.
The pattern: this batch aims at the console, not the endpoints
Look at the three together and a theme appears that no single CVE line captures. Endpoint management tools earn their central position by being trusted: trusted with credentials, trusted to hold evidence, trusted to report the truth about every host. This advisory erodes each. CVE-2026-18129 degrades the confidentiality of what EPM knows. CVE-2026-18127 degrades the integrity of what EPM records. CVE-2026-18125 degrades the availability of what EPM sees. Confidentiality, integrity, availability, one flaw each, all pointed at the console rather than the endpoints it manages.
An attacker who chained them would harvest the database credentials EPM stores, silence the agents that might notice the next move, and scrub the session recordings that would later prove any of it happened. None of the three is a dramatic remote-code-execution headline. That is the point. The flaws that quietly weaken a management plane are easier to overlook than a shell, and more useful to an intruder who wants to stay.
Why 'no public exploit' should not slow the patch
Ivanti's products sit behind a lot of enterprise perimeters, which makes them a standing target. From its Connect Secure VPN to Endpoint Manager Mobile, Ivanti gear has repeatedly landed on CISA's Known Exploited Vulnerabilities catalog over the past two years, often within weeks of a fix shipping. We saw the same shape with an Ivanti gateway earlier, where patching was only half the job and the hunt afterward was the other half.
The lesson repeats. On widely deployed management gear, "no public exploit today" is a statement about today, not a safety margin. It is the same dynamic that lets ordinary ransomware crews thrive on unpatched edge and management systems without ever touching a zero-day. Treat this advisory as time-sensitive even though nothing is being exploited as of publication.
Patch to 2024 SU7, then check what the flaws already touched
Upgrade every Endpoint Manager core server and agent to 2024 SU7. That closes all three. Then, because two of these bugs are about what an attacker could have done quietly, do not stop at the patch:
- If you ran a vulnerable version with session recording enabled, treat the recording store as potentially modifiable and corroborate any incident with independent logs, not the recordings alone.
- Watch for agents dropping offline in clusters, which is what the crash bug (CVE-2026-18125) looks like from the console.
- On the network side, the credential leak (CVE-2026-18129) depends on someone intercepting EPM's traffic, so confirm the management path is segmented and that certificate validation is not being downgraded anywhere in between.
The quiet versions of these are the ones that hurt: an agent going silent, an unexpected change to the recording store, a new device appearing on the management segment. Surfacing those means watching the management plane itself, not just the endpoints under it, which is exactly the kind of signal a managed threat-hunting layer is tuned to catch.
The console is the target now. Endpoint management earns its reach by being trusted with everything, and that is precisely why the flaws that matter most are the ones that erode the trust rather than pop a shell. SU7 is the easy part. Deciding whether you can still believe last month's session recordings is the harder one.