CVE-2026-18127: High severity Ivanti Ivanti Endpoint Manager vulnerability
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ivanti Endpoint Manager (Core)to a version that resolves this vulnerability.Fixed in 2024 SU7 - Compensating control
Ensure S3 bucket(s) used for session recording storage are not writable by external/compromised identities; restrict write access to only the specific, expected session-recording service role/account.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18127?
The severity of CVE-2026-18127 is rated high with a score of 7.7.
How do I fix CVE-2026-18127?
To fix CVE-2026-18127, update Ivanti Endpoint Manager to version 2024 SU7 or later.
What does CVE-2026-18127 affect?
CVE-2026-18127 affects Ivanti Endpoint Manager versions prior to 2024 SU7.
What type of attack does CVE-2026-18127 enable?
CVE-2026-18127 enables a remote authenticated attacker to gain full write control over an S3 bucket used for session recording storage.
What is the potential impact of CVE-2026-18127?
The potential impact of CVE-2026-18127 includes unauthorized data manipulation and storage concerns due to external control of a filename.