CVE-2026-18129
Received Received - Intake

Cleartext Transmission of Credentials in Ivanti Endpoint Manager

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: ivanti

Description
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-18129
EUVD
EUVD-2026-56158

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ivanti endpoint_manager to 2024_SU7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the transmission of sensitive information in plaintext within the Core of Ivanti Endpoint Manager before version 2024 SU7. A remote unauthenticated attacker positioned in a man-in-the-middle (MITM) scenario can exploit this to intercept and leak credentials used for external SQL connections.

Detection Guidance

Detecting this vulnerability requires monitoring network traffic for cleartext credential transmission in Ivanti Endpoint Manager. Check for unencrypted SQL connection strings or credentials in HTTP/HTTPS traffic between the application and external systems. Use packet capture tools like Wireshark or tcpdump to inspect traffic for sensitive data leaks.

Impact Analysis

An attacker could gain access to credentials for external SQL connections, potentially leading to unauthorized database access, data breaches, or further network compromise. This could expose sensitive data stored in those databases.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Upgrade Ivanti Endpoint Manager to version 2024 SU7 or later to address the cleartext transmission issue. Ensure network traffic is monitored for unauthorized credential leaks and enforce encrypted SQL connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart