What is the CVSS score of CVE-2026-18125?

CVE-2026-18125 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

How to fix or mitigate CVE-2026-18125?

Within 24 hours, conduct an inventory of all Ivanti Endpoint Manager Agent installations and identify systems running versions prior to 2024 SU7. Within 7 days, implement network-level controls by restricting firewall access to EPM agent communication ports to only authorized management workstations, and deploy monitoring on those ports to alert on unusual connection patterns. Within 30 days, upgrade all affected Ivanti Endpoint Manager Agent installations to version 2024 SU7 or later, beginning with systems managing critical business functions.

Ivanti EPM Agent CVE-2026-18125

EUVD-2026-56154 HIGH

Out-of-bounds Read (CWE-125)

2026-08-11 ivanti

GHSA-mr3q-2wp4-2885

Buffer Overflow Information Disclosure Ivanti Endpoint Manager

7.5

CVSS 3.1 · Vendor: ivanti

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach agent service network port
Delivery

Send malformed request packet
Exploit

Trigger out-of-bounds read in agent
Execution

Agent service process crashes
Impact

Endpoint loses EPM management coverage

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special configuration is required beyond the Ivanti EPM Agent service being network-reachable, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N. The Agent service runs by default on managed endpoints as part of standard EPM deployment, so any endpoint with EPM installed and the agent service running is potentially vulnerable. Exploitation is limited by network access: the attacker must be able to reach the agent service port from their position (local network, VPN, or internet-exposed segment). The impact is bounded to crashing the agent service (Availability only per vendor CVSS C:N/I:N); escalation to code execution has not been demonstrated. Versions 2024 SU7 and later are not affected.
Impact	The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) signals a straightforward, unauthenticated, network-reachable denial-of-service with no complexity bar. Real-world risk is high for organizations that expose EPM Agent service ports to untrusted network segments, as crashing agents severs endpoint visibility and management capability - a meaningful operational impact in environments dependent on EPM for patching and compliance. However, the risk profile is bounded by the absence of KEV listing, no reported EPSS data, and no known public exploit at time of analysis, suggesting no confirmed opportunistic mass exploitation. The 'Information Disclosure' tag warrants monitoring: if future research demonstrates reliable memory leakage alongside the crash, the confidentiality impact rating should be revisited. The impact is scoped to the agent service (S:U), so lateral compromise of the EPM server itself is not directly implied by this CVE.
Exploit ScenarioDerived	An unauthenticated remote attacker sends a specially crafted network packet to the Ivanti EPM Agent service port on a managed endpoint. The malformed input triggers an out-of-bounds read in the Agent's request-handling code, causing an unhandled exception and crashing the agent process. The affected endpoint loses its EPM management channel, removing it from patch compliance and monitoring visibility until the agent is restarted or the host is remediated.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 11, 2026

Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.

RemediationAI

Upgrade all Ivanti EPM deployments to version 2024 SU7 or later, as confirmed by the vendor advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-August-2026. Where immediate patching is not feasible, restrict network access to the EPM Agent service ports using host-based or network-layer firewall rules to permit only traffic from the authorised EPM server IP addresses - this reduces the attack surface to internal or trusted-network actors and limits unauthenticated remote reachability. Note that firewall restrictions may affect agent-to-server communication if misconfigured; test in a non-production environment before broad rollout. No alternative workaround eliminating the underlying OOB read has been documented by the vendor.

Affected VersionsENISA

Endpoint Manager patch: 2024 SU7

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Ivanti Endpoint Manager (EPM) is an enterprise IT asset and endpoint management platform; the Agent component runs on managed endpoints and communicates back to the EPM server. CWE-125 (Out-of-Bounds Read) indicates the Agent's network-facing service reads beyond the bounds of an allocated memory buffer when processing attacker-controlled input, triggering a crash. The CPE string cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* covers all versions of the product across all platforms. Notably, while the vulnerability class (OOB read) can in some configurations leak adjacent memory contents - hence the 'Information Disclosure' tag in source intelligence - the vendor's CVSS assessment records C:N, indicating Ivanti has not confirmed exfiltration of sensitive data as a demonstrated outcome; the practical confirmed impact is a service crash.

Know when Endpoint Manager gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (ivanti) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Network-reachable agent service requires no auth; crash-only impact maps to A:H with no confirmed confidentiality or integrity effect per vendor assessment.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ivanti).

CVSS VectorVendor: ivanti

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.

Articles & Coverage 2

News 3 New Ivanti Vulnerabilities - 3 High Severity Patched Aug 12, 2026 News 3 New Ivanti Vulnerabilities - 3 High Severity Aug 11, 2026

Executive ViewAI

Why It Matters

Ivanti Endpoint Manager Agent versions prior to 2024 SU7 are vulnerable to unauthenticated remote denial-of-service attacks that crash the agent service. This vulnerability affects organizations' ability to manage and monitor their endpoint infrastructure, creating operational risk until patched. With no vendor patch currently available, organizations must implement interim protective measures immediately.

Business Impact: High

Compensating Controls

Until Ivanti Endpoint Manager Agent version 2024 SU7 or later is deployed: restrict network access to EPM agent ports via firewall rules; implement rate-limiting on agent communication ports to inhibit successful DoS attempts; configure automated service restart policies for EPM agents to minimize downtime from exploitation; deploy network monitoring and alerting for anomalous connection attempts to EPM agents.

Threat Intelligence Overview

EPSS Score

0.8%

Top 47% exploitable

Prevalence

Medium

enterprise endpoint management platform, significant but non-universal deployment

Data Quality

6 sources

Confidence: High

EUVD Ivanti

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.8%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.