Ivanti patched four vulnerabilities in Endpoint Manager (EPM) and Neurons for MDM. In EPM, CVE-2026-18129 involves cleartext transmission of sensitive information exploitable by a man-in-the-middle attacker to leak credentials for external SQL connections. CVE-2026-18125 is an out-of-bounds read flaw that can crash the EPM agent service. CVE-2026-18127 is an input validation weakness allowing authenticated attackers to control filenames and gain full write control over an S3 bucket used for session recording storage. These were fixed in EPM version 2024 SU7. Neurons for MDM had a medium-severity command injection vulnerability patched in version R124 of the cloud SaaS platform, requiring no customer action. Ivanti reported no known exploitation of these vulnerabilities at disclosure time.

Successful exploitation of CVE-2026-18129 could allow an unauthenticated remote attacker in a man-in-the-middle position to leak credentials for external SQL connections, potentially compromising database access. CVE-2026-18125 could cause denial of service by crashing the EPM agent service. CVE-2026-18127 could allow an authenticated attacker to gain full write control over an S3 bucket configured for session recording storage, risking data integrity and confidentiality. The Neurons for MDM vulnerability could disclose sensitive information via remote command injection but requires no customer action due to vendor-managed patching. No evidence of exploitation in the wild has been reported.

Ivanti has released official patches addressing these vulnerabilities. For Endpoint Manager, upgrade to version 2024 SU7 or later to remediate the high-severity flaws. For Neurons for MDM, the cloud-based SaaS platform was patched in version R124, and no customer action is required. Organizations should apply these updates promptly to mitigate risk. Monitor Ivanti's security advisories for further updates.