Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7

CVE-2026-18129 is an improper certificate validation / cleartext transmission flaw (CWE-295) in the Ivanti Endpoint Manager Core server. The EPM Core transmits SQL database credentials in cleartext (or without proper TLS certificate validation) when connecting to its external SQL backend. An attacker who can position themselves on the network path between the EPM Core and its SQL server — via ARP spoofing, DHCP hijacking, or compromised switch — can intercept those credentials without any authentication or user interaction. All versions of Ivanti EPM through 2024 SU6 are affected; the fix ships in 2024 SU7, released August 11, 2026.

Ivanti rates this HIGH at 8.1, and the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) already reflects the High attack complexity that a MitM position implies. That AC:H modifier is doing real work here — this is not a point-and-shoot remote exploit. However, the vendor score arguably *over*-weights the theoretical 'unauthenticated remote' framing. In practice, you need to already be on the internal network segment between EPM Core and its SQL server — a position that implies prior compromise and significant lateral movement. We pull the score down to 7.0 while keeping the HIGH bucket because the blast radius through the EPM management plane is fleet-scale.

Why this verdict

• MitM friction is real and compounding. The CVSS AC:H already discounts for MitM difficulty, but it does not capture that the attacker must (a) gain initial internal access, (b) reach the specific management VLAN, and (c) defeat Layer 2 controls like DAI and DHCP snooping — three compounding prerequisites that narrow the practical attacker population significantly.
• No PoC, no exploitation, low EPSS. With an EPSS of 0.00871, no public exploit code, and Ivanti confirming zero known exploitation at disclosure, the near-term threat is theoretical. The vulnerability was disclosed with a patch available on the same day.
• Role multiplier: EPM Core is a fleet-management server — chain ends in fleet compromise. Every Ivanti EPM deployment has a Core server by definition (100% of installs are in the high-value role). If an attacker reaches the SQL database, they can potentially modify software distribution packages and push malicious payloads to all managed endpoints. This fleet-scale blast radius sets a HIGH floor that friction alone cannot override.
• Internal-only attack surface. Unlike EPMM (mobile) vulnerabilities that have been exploited via internet-facing consoles (CVE-2026-1281, CVE-2026-1340), the Core-to-SQL credential path is entirely internal. The ~1,400-1,900 exposed EPM instances on Censys/Shadowserver are management consoles, not the vulnerable traffic path.

Why not higher?

CRITICAL would require either active exploitation, a public PoC, or a lower-friction attack path. The MitM requirement (AC:H) is a genuine barrier — it requires Layer 2 adjacency on the EPM-to-SQL segment, which assumes prior compromise and specific lateral movement. No threat actor has demonstrated this chain, and the EPSS of 0.00871 confirms low near-term exploitation probability.

Why not lower?

MEDIUM would undercount the blast radius. The EPM Core is not a peripheral service — it *is* the fleet management plane. An attacker who completes this chain gains SQL-level control over endpoint inventory, configuration, and software distribution for potentially thousands of managed hosts. The role-multiplier floor rule keeps this at HIGH regardless of MitM friction.

1. Enforce TLS with certificate pinning on EPM Core-to-SQL connections — If your SQL deployment supports forced encryption (SQL Server: Force Encryption = Yes in Configuration Manager), enable it immediately. This neutralizes the cleartext transmission regardless of patch status. Deploy within the noisgate mitigation SLA of 30 days for HIGH.
2. Enable Dynamic ARP Inspection and DHCP Snooping on management VLANs — These Layer 2 controls prevent the ARP spoofing required for MitM positioning. If not already enabled on the VLAN hosting EPM Core and SQL, prioritize deployment. Most enterprise-grade switches (Cisco, Arista, Juniper) support this natively.
3. Restrict SQL server source IP access to EPM Core only — Configure Windows Firewall or SQL Server network rules to accept connections only from the EPM Core server's IP address. This limits the utility of stolen credentials even if intercepted.
4. Enable SQL Server audit logging for login events — Turn on SQL Server Audit or Extended Events to log all authentication attempts. Alert on connections from unexpected source IPs. This provides detection coverage for credential reuse after interception.
5. Segment EPM infrastructure onto a dedicated management VLAN — If EPM Core and SQL share a VLAN with general-purpose servers or workstations, isolate them. This reduces the population of hosts that could perform MitM. Standard network hygiene but directly relevant here.

Run this on the EPM Core server itself as a local administrator. It checks the installed EPM version against the patched release. Example: .\Check-CVE-2026-18129.ps1 from an elevated PowerShell prompt.

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether Ivanti EPM is patched against CVE-2026-18129.
.DESCRIPTION
    Reads the installed EPM version from the registry and compares
    against the fixed version (2024 SU7).
.OUTPUTS
    VULNERABLE, PATCHED, or UNKNOWN with exit codes 1, 0, 2.
#>

$ErrorActionPreference = 'Stop'

try {
    # Check common registry paths for Ivanti EPM / LANDesk
    $regPaths = @(
        'HKLM:\SOFTWARE\LANDesk\ManagementSuite\Setup',
        'HKLM:\SOFTWARE\Ivanti\ManagementSuite\Setup',
        'HKLM:\SOFTWARE\WOW6432Node\LANDesk\ManagementSuite\Setup',
        'HKLM:\SOFTWARE\WOW6432Node\Ivanti\ManagementSuite\Setup'
    )

    $version = $null
    $suLevel = $null

    foreach ($path in $regPaths) {
        if (Test-Path $path) {
            $props = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
            if ($props.ProductVersion) {
                $version = $props.ProductVersion
            }
            if ($props.ServiceUpdate) {
                $suLevel = $props.ServiceUpdate
            }
            if ($version) { break }
        }
    }

    if (-not $version) {
        # Try checking installed programs
        $epm = Get-WmiObject -Class Win32_Product -Filter "Name LIKE '%Ivanti Endpoint Manager%' OR Name LIKE '%LANDesk Management Suite%'" -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($epm) {
            $version = $epm.Version
        }
    }

    if (-not $version) {
        Write-Host 'UNKNOWN - Ivanti EPM not detected on this host.'
        exit 2
    }

    Write-Host "Detected EPM version: $version (SU: $suLevel)"

    # Parse version - 2024 SU7 is the fix
    # Version format varies; check for 2024 base + SU level
    $parsedVersion = [version]$version

    # If version year is 2024 and SU >= 7, or version year > 2024: patched
    if ($parsedVersion.Major -gt 2024) {
        Write-Host 'PATCHED - EPM version is newer than 2024.'
        exit 0
    }
    elseif ($parsedVersion.Major -eq 2024) {
        if ($suLevel -and [int]$suLevel -ge 7) {
            Write-Host 'PATCHED - EPM 2024 SU7 or later detected.'
            exit 0
        }
        elseif ($suLevel) {
            Write-Host "VULNERABLE - EPM 2024 SU$suLevel detected. SU7 required (CVE-2026-18129)."
            exit 1
        }
        else {
            # 2024 base without SU info - assume vulnerable
            Write-Host 'VULNERABLE - EPM 2024 base detected without SU7. Update required (CVE-2026-18129).'
            exit 1
        }
    }
    else {
        Write-Host "VULNERABLE - EPM $($parsedVersion.Major) detected. Upgrade to 2024 SU7 required (CVE-2026-18129)."
        exit 1
    }
}
catch {
    Write-Host "UNKNOWN - Error during detection: $_"
    exit 2
}

Sources

1. CybersecurityNews — Ivanti EPM Agent Crash Vulnerability Advisory
2. OffSeq Threat Radar — Ivanti EPM SU7 Remotely Exploitable Flaws
3. Censys Advisory — Ivanti Endpoint Manager Zero-Days
4. Ivanti Hub — Security Advisory EPM May 2026
5. Rapid7 — Ivanti EPMM Zero-Day Exploitation (CVE-2026-1281/1340)
6. BleepingComputer — Ivanti EPM Active Exploitation
7. Ivanti EPM 2024 Readme