CVE-2026-18127: Ivanti Endpoint Manager Privilege Escalation

CVE-2026-18127 Overview

CVE-2026-18127 is an external control of filename vulnerability [CWE-73] in the Core component of Ivanti Endpoint Manager (EPM). A remote authenticated attacker can gain full write control over an Amazon S3 bucket configured for session recording storage. The flaw affects Ivanti Endpoint Manager versions prior to 2024 SU7. Successful exploitation enables integrity impact against session recording data without requiring user interaction.

Critical Impact
An authenticated attacker with network access can overwrite, replace, or plant arbitrary files in the S3 bucket used for session recording storage, compromising the integrity of forensic and audit data.

Affected Products

Ivanti Endpoint Manager (EPM) versions prior to 2024 SU7
Ivanti EPM deployments configured with S3-backed session recording storage
Ivanti EPM Core component

Discovery Timeline

2026-08-11 - CVE CVE-2026-18127 published to NVD
2026-08-11 - Last updated in NVD database
August 2026 - Ivanti publishes security advisory for Endpoint Manager

Technical Details for CVE-2026-18127

Vulnerability Analysis

The vulnerability resides in the Core component of Ivanti Endpoint Manager. It stems from external control of a filename or path parameter [CWE-73] used when writing session recording artifacts to an S3 bucket. Because the application accepts attacker-influenced filename input, a remote authenticated attacker can direct writes to arbitrary object keys within the configured bucket.

The impact is scoped to integrity. Attackers cannot directly read stored content or degrade availability of the EPM service, but they can overwrite existing session recordings, insert fabricated recordings, or corrupt evidence used for compliance and investigation. The scope change indicates that exploitation crosses a trust boundary from the EPM application into the connected S3 storage resource.

Root Cause

The root cause is insufficient validation and sanitization of a filename or object key parameter used by the Core service when persisting session recordings. Refer to the Ivanti Security Advisory August 2026 for vendor technical details.

Attack Vector

Exploitation requires network access to the EPM Core and low-privilege authenticated credentials. The attacker submits crafted input that controls the destination filename or path for the session recording write operation. The EPM Core then performs the write against the configured S3 bucket using its own credentials, granting the attacker effective write control over bucket contents. No user interaction is required.

See the Ivanti Security Advisory August 2026 for additional attack surface details. A public proof-of-concept exploit was not available at the time of publication.

Detection Methods for CVE-2026-18127

Indicators of Compromise

Unexpected PutObject, CopyObject, or DeleteObject events in the S3 bucket used for EPM session recording storage, especially against keys outside the expected naming scheme.
Session recording objects with unusual paths, extensions, or content types that do not match legitimate EPM output.
Modifications to existing session recording objects that were previously immutable in normal operation.

Detection Strategies

Enable AWS CloudTrail data events for the S3 bucket backing EPM session recording, then baseline the object key patterns produced by legitimate EPM writes.
Alert on write operations from the EPM Core service identity that target object keys outside the expected prefix or naming convention.
Correlate authenticated EPM Core activity with S3 write events to identify anomalous user-to-object mappings.

Monitoring Recommendations

Ingest EPM Core application logs and AWS CloudTrail S3 data events into a centralized analytics platform for cross-source correlation.
Monitor authenticated EPM user actions that generate session recording writes and flag deviations from historical baselines.
Track integrity of session recording objects with checksums or S3 Object Lock audit logs to detect unauthorized overwrites.

How to Mitigate CVE-2026-18127

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU7 or later as specified in the vendor advisory.
Rotate the IAM credentials or role used by the EPM Core to access the S3 session recording bucket after patching.
Audit recent S3 write activity against the session recording bucket to identify any unauthorized object modifications.

Patch Information

Ivanti addressed CVE-2026-18127 in Endpoint Manager 2024 SU7. Apply the vendor-supplied update according to the guidance in the Ivanti Security Advisory August 2026.

Workarounds

Restrict the IAM policy attached to the EPM Core service to the minimum object key prefix required for session recording, denying writes outside that prefix.
Enable S3 Object Lock or versioning on the session recording bucket to preserve prior object versions and support recovery from unauthorized overwrites.
Limit access to authenticated EPM accounts through strong authentication and principle-of-least-privilege role assignments until the patch is applied.

bash

# Example restrictive S3 bucket policy limiting EPM Core writes to an approved prefix
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictEPMWritesToPrefix",
      "Effect": "Deny",
      "Principal": { "AWS": "arn:aws:iam::<account-id>:role/EPMCoreRole" },
      "Action": [ "s3:PutObject", "s3:DeleteObject" ],
      "Resource": "arn:aws:s3:::epm-session-recordings/*",
      "Condition": {
        "StringNotLike": {
          "s3:prefix": "sessions/approved/*"
        }
      }
    }
  ]
}