Summary
- Endpoint Manager 2024 SU7 addresses three high-severity vulnerabilities.
- CVE-2026-18125 lets an unauthenticated remote attacker crash the EPM agent service.
- CVE-2026-18129 can expose credentials used for external SQL connections, but exploitation requires a man-in-the-middle position.
Ivanti has released Endpoint Manager 2024 SU7 to address three high-severity vulnerabilities, including weaknesses that can be reached remotely without authentication under different technical conditions.
CVE-2026-18125 is an out-of-bounds read in the Endpoint Manager agent. Ivanti says a remote unauthenticated attacker can trigger the flaw to crash the agent service, creating a denial-of-service condition rather than direct remote code execution.
A separate vulnerability, CVE-2026-18129, concerns cleartext transmission of sensitive information in the Endpoint Manager core. An unauthenticated attacker in a man-in-the-middle position may be able to obtain credentials used for external SQL connections.
The man-in-the-middle requirement is an important constraint. The vulnerability is remotely reachable without an Endpoint Manager account, but it does not mean any arbitrary internet host can simply request SQL credentials from an exposed server. The attacker must be positioned to intercept or manipulate the relevant communication path.
The third high-severity issue, CVE-2026-18127, concerns write access to an Amazon S3 bucket used for session-recording storage and requires authentication. Together, the flaws affect different portions of the Endpoint Manager trust model rather than forming one unauthenticated takeover chain.
Ivanti has said it is not aware of customers being exploited through the August vulnerabilities. The current response is therefore remediation rather than evidence of an active campaign.
Endpoint-management products deserve disproportionate attention even when individual bugs have limited direct effects because the platform itself is designed to operate across large parts of a device estate. Management agents, deployment services and administrative credentials create relationships that ordinary desktop applications do not possess.
A denial-of-service flaw in an agent can interfere with management visibility or service availability, while compromise of database credentials can create a separate route towards information held outside Endpoint Manager itself. The effects depend on how the platform has been integrated and what permissions its supporting accounts possess.
That architecture also complicates ownership. Endpoint-management infrastructure may be maintained by an internal workplace team, a security function or an external managed service provider, while the databases and cloud storage it uses sit under separate administration.
European resilience requirements increasingly place weight on those dependencies. NIS2 and DORA both encourage organisations to look beyond individual devices towards the governance and third parties supporting essential technology functions, making the management plane part of the wider risk assessment.
The August release arrives during a heavy enterprise patch cycle, but vulnerability queues cannot be prioritised solely by comparing CVSS numbers. A flaw in software authorised to administer hundreds or thousands of endpoints can justify accelerated treatment even where the immediate effect is narrower than code execution.
The corrected EPM 2024 SU7 release provides the remediation point for affected installations. Organisations assessing exposure need to distinguish the individual CVEs and their prerequisites rather than treating the advisory as evidence of a single unauthenticated remote compromise route.
That precision affects incident response as well as patching. A customer concerned about CVE-2026-18129 needs to examine the communications path and SQL credentials involved, while CVE-2026-18125 is principally an availability issue affecting the agent service. The same product release fixes both, but the risks are not interchangeable.
