Ivanti Endpoint Manager CVE-2026-18127

Exploitation requires valid EPM credentials at any authenticated privilege level (PR:L per CVSS vector). The S3 bucket session recording feature must be explicitly configured in the EPM deployment - this is not a default out-of-box setting and limits exposure to environments that have enabled and connected S3-based recording storage. Network-level access to the EPM Core service over the internet or internal network is required (AV:N). Exploitation is limited to write operations within the configured S3 bucket; there is no indication of cross-account bucket access or read/exfiltration capability based on available description data.

The CVSS 7.7 High rating is driven primarily by the scope change (S:C) and high integrity impact (I:H) against the S3 bucket, with low authentication (PR:L) and no user interaction (UI:N) keeping exploitation straightforward for any valid EPM account holder. The attack complexity is rated Low, though the vulnerability is only exploitable when S3 session recording storage is explicitly configured - a deployment-specific prerequisite not captured in the base CVSS vector. No EPSS data was provided, and neither KEV status nor public POC code has been identified, which reduces immediate operational urgency despite the high base score. Real-world risk is best framed as an insider or compromised-credential threat: the attacker already holds EPM credentials and can now tamper with forensic session recordings - covering tracks, injecting false recordings, or corrupting incident response data. The tag 'Information Disclosure' in the source intelligence appears to be a mis-categorization; the impact is integrity-focused (write control), not confidentiality.

An authenticated EPM user - such as a help-desk operator or a threat actor who has phished EPM credentials - submits a session recording request with a crafted filename containing path traversal or arbitrary key sequences. The EPM Core component passes this unsanitized value directly to the S3 API, writing the attacker's payload to an arbitrary key in the recording bucket. With full write control, the attacker can overwrite legitimate session recordings, inject fabricated recordings, or delete forensic artifacts ahead of an investigation. No public POC code has been identified at time of analysis.