CVE-2026-18128: Medium severity vulnerability

Published Nov 10, 2026

Updated

Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ivanti Endpoint Manager Agent to a version that resolves this vulnerability.
Fixed in 2024 SU8

Event History

Nov 10, 2026

CVE Published

via MITRE·03:30 PM

Data Sourced

via MITRE·03:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions must an attacker meet to exploit this issue?

The attacker must be remote, unauthenticated, and in a man-in-the-middle position where they can intercept the affected agent's HTTP traffic. Exploitation also requires user interaction and is rated high attack complexity.

Which deployments are affected?

Ivanti Endpoint Manager Agent versions before 2024 SU8 are affected. The provided information does not specify any configuration prerequisite beyond use of an affected agent version.

What can an attacker do if exploitation succeeds?

An attacker positioned to intercept the traffic can read and modify HTTP traffic, potentially exposing sensitive information and compromising its integrity. The supplied severity vector indicates no direct availability impact.

CVE-2026-18128: Medium severity vulnerability

Remediation

Event History

Frequently Asked Questions

What conditions must an attacker meet to exploit this issue?

Which deployments are affected?

What can an attacker do if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What conditions must an attacker meet to exploit this issue?

Which deployments are affected?

What can an attacker do if exploitation succeeds?