CVE Catalog
CVE-2026-18129
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk0.87%
56th percentile - higher than 56% of all known CVEs
Summary
Ivanti Endpoint Manager before 2024 SU7 transmits sensitive information in cleartext, allowing a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
Risk Assessment
An attacker can obtain SQL credentials, potentially leading to unauthorized database access and data confidentiality breach.
Recommendation
Update Ivanti Endpoint Manager to version 2024 SU7 or later, which includes the fix.
Original NVD description (English source)
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.