Ivanti Endpoint Manager CVE-2026-18129

Exploitation requires the attacker to occupy a man-in-the-middle network position on the communication path between the Ivanti EPM Core component and the external SQL server it connects to - this is the primary limiting condition. No authentication to EPM is required (PR:N per CVSS). No user interaction is needed (UI:N). The vulnerable behavior is in the Core component specifically, not EPM agent endpoints. Key limiting factors: the attacker must control or intercept a network segment carrying EPM-to-SQL traffic, which typically means physical network proximity, access to a network device (switch, router), or the ability to perform ARP/DNS spoofing within the relevant subnet. Remote internet-based exploitation is unlikely unless the SQL connection traverses a public or poorly controlled WAN segment. The flaw is present in all EPM Core versions before 2024 SU7 regardless of other configuration settings.

The official CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity but conditionally exploitable vulnerability. AC:H is appropriate - achieving a MITM position requires either physical network access, compromise of a network device (switch, router, ARP spoofing capability), or DNS/BGP-level manipulation, all of which represent meaningful attacker preconditions. The C:H is well-justified given credential theft. I:H and A:H in the official vector appear to account for a full MITM capability (traffic modification and connection disruption), though the description itself focuses only on credential leakage - this independence from the description makes I:H and A:H somewhat speculative rather than directly stated. No EPSS data was provided in the intelligence, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No POC is known. In practice, the most realistic risk is credential theft leading to lateral movement against the SQL backend - a high-impact outcome if EPM's SQL database contains endpoint configuration, software distribution policies, or privileged account data. Organizations with EPM Core servers on flat or insufficiently segmented networks face the greatest exposure.

An attacker with access to the network path between the Ivanti EPM Core server and its external SQL backend - achieved via ARP spoofing on a local segment, compromise of a network switch, or a rogue device on the same VLAN - intercepts the unencrypted or improperly validated SQL connection. The attacker captures plaintext SQL credentials from the connection setup or authentication exchange and subsequently authenticates directly to the SQL server, gaining access to EPM's full management database. No public exploit code is known at time of analysis, but the attack does not require specialized tooling beyond standard network interception utilities.