What is the CVSS score of EUVD-2026-56154?

EUVD-2026-56154 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of Ivanti EPM Agent are affected by EUVD-2026-56154?

Ivanti Endpoint Manager Agent versions prior to 2024 SU7 are vulnerable to unauthenticated remote denial-of-service attacks that crash the agent service.

How to fix or mitigate EUVD-2026-56154?

Within 24 hours, conduct an inventory of all Ivanti Endpoint Manager Agent installations and identify systems running versions prior to 2024 SU7. Within 7 days, implement network-level controls by restricting firewall access to EPM agent communication ports to only authorized management workstations, and deploy monitoring on those ports to alert on unusual connection patterns. Within 30 days, upgrade all affected Ivanti Endpoint Manager Agent installations to version 2024 SU7 or later, beginning with systems managing critical business functions.

Ivanti EPM Agent EUVD-2026-56154

| CVE-2026-18125 HIGH

Out-of-bounds Read (CWE-125)

2026-08-11 ivanti

GHSA-mr3q-2wp4-2885

Buffer Overflow Information Disclosure Ivanti Endpoint Manager

7.5

CVSS 3.1 · Vendor: ivanti

Severity by source

Vendor (ivanti) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable agent service requires no auth; crash-only impact maps to A:H with no confirmed confidentiality or integrity effect per vendor assessment.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ivanti).

CVSS VectorVendor: ivanti

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 15:08 vuln.today

CVE Published

Aug 11, 2026 - 14:18 cve.org

HIGH 7.5

DescriptionCVE.org

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.

Articles & Coverage 2

News 3 New Ivanti Vulnerabilities - 3 High Severity Patched Aug 12, 2026 News 3 New Ivanti Vulnerabilities - 3 High Severity Aug 11, 2026

AnalysisAI

Denial-of-service via out-of-bounds read in the Ivanti Endpoint Manager Agent (all versions before 2024 SU7) allows remote unauthenticated attackers to crash the agent service with a single crafted network request. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this trivially exploitable from any network-reachable position. No public exploit code or CISA KEV listing has been identified at time of analysis; impact is limited to availability disruption of the EPM agent, with no confirmed confidentiality or integrity consequence.

Technical ContextAI

Ivanti Endpoint Manager (EPM) is an enterprise IT asset and endpoint management platform; the Agent component runs on managed endpoints and communicates back to the EPM server. CWE-125 (Out-of-Bounds Read) indicates the Agent's network-facing service reads beyond the bounds of an allocated memory buffer when processing attacker-controlled input, triggering a crash. The CPE string cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* covers all versions of the product across all platforms. Notably, while the vulnerability class (OOB read) can in some configurations leak adjacent memory contents - hence the 'Information Disclosure' tag in source intelligence - the vendor's CVSS assessment records C:N, indicating Ivanti has not confirmed exfiltration of sensitive data as a demonstrated outcome; the practical confirmed impact is a service crash.

RemediationAI

Upgrade all Ivanti EPM deployments to version 2024 SU7 or later, as confirmed by the vendor advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-August-2026. Where immediate patching is not feasible, restrict network access to the EPM Agent service ports using host-based or network-layer firewall rules to permit only traffic from the authorised EPM server IP addresses - this reduces the attack surface to internal or trusted-network actors and limits unauthenticated remote reachability. Note that firewall restrictions may affect agent-to-server communication if misconfigured; test in a non-production environment before broad rollout. No alternative workaround eliminating the underlying OOB read has been documented by the vendor.