CVE-2026-18125: Ivanti Endpoint Manager DoS Vulnerability

CVE-2026-18125 Overview

CVE-2026-18125 is an out-of-bounds read vulnerability [CWE-125] in the Agent component of Ivanti Endpoint Manager (EPM). The flaw allows a remote unauthenticated attacker to crash the agent service, resulting in a denial of service condition on affected endpoints. All versions of Ivanti Endpoint Manager prior to 2024 SU7 are affected.

Because the EPM agent runs on managed endpoints across the enterprise, a successful attack removes management visibility and can disrupt patch delivery, software distribution, and inventory reporting until the service is restored.

Critical Impact
Remote unauthenticated attackers can crash the Ivanti EPM agent service across managed endpoints, disrupting endpoint management operations without requiring credentials or user interaction.

Affected Products

Ivanti Endpoint Manager (EPM) versions prior to 2024 SU7
Ivanti EPM Agent component
Managed Windows endpoints running the vulnerable agent

Discovery Timeline

2026-08-11 - CVE-2026-18125 published to the National Vulnerability Database
2026-08-11 - Ivanti publishes the Ivanti Security Advisory for EPM August 2026
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18125

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Ivanti EPM Agent. Out-of-bounds read defects occur when a program reads memory outside the bounds of an allocated buffer. In this case, the read triggers a fault that terminates the agent service process.

The attack is reachable over the network without authentication and without user interaction. The impact is limited to availability. Confidentiality and integrity of data are not directly affected by this specific defect, according to the published advisory.

With an EPSS score of 0.775%, the probability of near-term exploitation is currently modeled as low, but the low complexity of the network attack surface warrants prompt remediation.

Root Cause

The root cause is missing or incorrect bounds validation when the agent parses attacker-supplied input. When a malformed request reaches a vulnerable handler, the agent reads past the end of an allocated buffer. The invalid read produces an access violation that crashes the service. Refer to the Ivanti Security Advisory for vendor-specific technical detail.

Attack Vector

An attacker sends a crafted network request to the exposed EPM Agent listener on a managed endpoint. No credentials are required. The malformed request triggers the out-of-bounds read, and the agent process terminates. Repeated requests keep the agent offline, breaking management channels between the EPM core server and affected endpoints.

No public proof-of-concept exploit is currently listed for CVE-2026-18125, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list at time of publication.

Detection Methods for CVE-2026-18125

Indicators of Compromise

Unexpected termination or repeated restarts of the Ivanti EPM Agent service on managed endpoints
Application or system event log entries showing access violation crashes in the EPM agent binary
Loss of check-in telemetry from managed endpoints in the EPM console without corresponding endpoint shutdown
Inbound network traffic to the EPM agent listener from unexpected or external sources

Detection Strategies

Monitor Windows Service Control Manager events for stops and restarts of the Ivanti EPM Agent service
Alert on Windows Error Reporting or Application Error events (Event ID 1000) referencing the agent process
Correlate agent check-in gaps in the EPM console with host-level crash events to identify targeted denial of service activity

Monitoring Recommendations

Track EPM agent process uptime and generate alerts when crashes exceed a baseline threshold
Inspect network flow data for anomalous connections to EPM agent listening ports from non-EPM infrastructure
Review endpoint management console reports daily for endpoints that stop reporting in without a legitimate maintenance window

How to Mitigate CVE-2026-18125

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU7 or later on all core servers and agents
Restrict network access to the EPM agent listener so that only the EPM core server and authorized management infrastructure can reach it
Inventory all managed endpoints and confirm agent version compliance after the upgrade

Patch Information

Ivanti has released a fixed version in Ivanti Endpoint Manager 2024 SU7. Administrators should apply the update as documented in the Ivanti Security Advisory for EPM August 2026. Verify agent versions from the EPM console after deployment.

Workarounds

Apply network segmentation and host-based firewall rules to limit inbound traffic to the EPM agent to trusted management subnets
Monitor for and automatically restart the EPM agent service to reduce the availability window if a crash occurs
Isolate internet-exposed endpoints running the EPM agent from untrusted networks until the patch is applied

bash

# Example Windows Firewall rule to restrict EPM Agent inbound access to a management subnet
New-NetFirewallRule -DisplayName "Restrict Ivanti EPM Agent" `
  -Direction Inbound `
  -Program "C:\Program Files (x86)\LANDesk\LDClient\residentagent.exe" `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow