EUVD-2026-56158
GHSA-4wmw-x67r-qxgq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MITM position required justifies AC:H; credential theft and traffic modification support C:H and I:H; no availability impact directly described.
Primary rating from Vendor (ivanti).
CVSS VectorVendor: ivanti
Lifecycle Timeline
2DescriptionCVE.org
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
Articles & Coverage 2
AnalysisAI
Cleartext SQL credential transmission in Ivanti Endpoint Manager Core before version 2024 SU7 exposes database credentials to any attacker capable of occupying a man-in-the-middle network position on the path between EPM Core and its external SQL backend. The underlying root cause is classified as CWE-295 (Improper Certificate Validation), suggesting the Core component fails to properly enforce TLS certificate validation - likely causing connections to proceed over unencrypted or improperly verified channels. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to occupy a man-in-the-middle network position on the communication path between the Ivanti EPM Core component and the external SQL server it connects to - this is the primary limiting condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity but conditionally exploitable vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Ivanti Endpoint Manager to version 2024 SU7 or later, per the Ivanti August 2026 security advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Ivanti EPM Core instances and map network paths to their SQL databases, prioritizing instances with connectivity through internet-facing or untrusted network segments; establish baseline monitoring on database connection traffic for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Endpoint Manager
View allIvanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to l
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosu
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosur
Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthen
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege es
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device r
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an aut
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allow
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unau
Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today