CVE Catalog
CVE-2026-18127
HighCVSS 7.7Summary
Ivanti Endpoint Manager before 2024 SU7 has a vulnerability related to external control of a filename, allowing a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
Risk Assessment
An attacker can manipulate files in the S3 bucket, potentially leading to data integrity issues or unauthorized access to session recordings.
Recommendation
Update Ivanti Endpoint Manager to version 2024 SU7 or later, which includes the fix.
Original NVD description (English source)
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.