967 matches found
Ivanti Endpoint Manager - Authentication Bypass
Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...
Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard
A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...
CVE-2026-18129
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...
CVE-2026-18129
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...
CVE-2026-18129
CVE-2026-18129 affects the Core of Ivanti Endpoint Manager prior to version 2024 SU7. The issue is cleartext transmission of sensitive information, allowing a remote, unauthenticated attacker in a MITM position to leak credentials used for external SQL connections. CVSS v3.1 metrics report high i...
CVE-2026-18129
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...
EUVD-2026-56158
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...
CVE-2026-18127
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...
CVE-2026-18127
CVE-2026-18127 affects Ivanti Endpoint Manager core prior to 2024 SU7. An authenticated, network-accessible attacker can externally control a filename in the Core, enabling full write access to an S3 bucket used for session-recording storage. The CVSS score is 7.7 (HIGH); attack requires low priv...
EUVD-2026-56157
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...
CVE-2026-18125
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service...
EUVD-2026-56154
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service...
CVE-2026-18125
CVE-2026-18125 reports an out-of-bounds read in the Ivanti Endpoint Manager Agent prior to 2024 SU7, allowing a remote unauthenticated attacker to crash the agent service (CVSS v3.1 base score 7.5, HIGH). Affected software: Ivanti Endpoint Manager Agent (pre-2024 SU7). The document does not provi...
PT-2026-70215
Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU7 Description Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager allows a remote unauthenticated attacker in a Man-in-the-Middle MITM position—where an attack...
PT-2026-70214
Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU7 Description An issue in the Core of the software allows a remote authenticated attacker to gain full write control over an S3 bucket used for session recording storage. This is caused by...
PT-2026-70213
Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU7 Description An out-of-bounds read in the Agent allows a remote unauthenticated attacker to crash an agent service. An out-of-bounds read occurs when a program reads data past the end of the...
Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-10727)
Update 11 June: FAQ Updated Summary Ivanti has released updates for Ivanti Endpoint Manager Mobile EPMM which addresses one high severity vulnerability. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details CVE Number | Descriptio...
CVE-2026-8109
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials...