CVE-2026-18127: Ivanti Endpoint Manager

High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days.

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

Affected products

• Ivanti Endpoint Manager

Published 2026-08-11. Last modified 2026-08-31.