CVE-2026-18129: Ivanti Endpoint Manager Cleartext Vulnerability

CVE-2026-18129 Overview

CVE-2026-18129 is a cleartext transmission vulnerability affecting the Core component of Ivanti Endpoint Manager (EPM) prior to version 2024 SU7. The flaw permits a remote, unauthenticated attacker positioned to intercept network traffic to observe credentials transmitted for external SQL connections. The weakness maps to [CWE-295] (Improper Certificate Validation) and is exploited from a man-in-the-middle (MITM) position on the network path between the EPM Core and its external SQL database.

Critical Impact
An attacker in a MITM position can capture SQL credentials used by Ivanti EPM Core, enabling unauthorized access to backend databases containing endpoint management data.

Affected Products

Ivanti Endpoint Manager (EPM) versions prior to 2024 SU7
Ivanti EPM Core component responsible for external SQL connectivity
Deployments where the EPM Core communicates with a remote SQL Server instance

Discovery Timeline

2026-08-11 - CVE-2026-18129 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18129

Vulnerability Analysis

The vulnerability resides in the way Ivanti Endpoint Manager Core establishes connections to external SQL databases. The Core transmits authentication material for SQL connections without enforcing sufficient transport-layer protections or proper certificate validation. As a result, an attacker who can observe or interpose on the network segment between the EPM Core and the SQL backend can capture credentials in cleartext or downgrade an intended secure channel.

Exploitation requires network positioning between the Core server and the SQL host, which raises attack complexity. Once credentials are captured, the attacker can authenticate directly to the SQL backend and read or modify data used by EPM to manage endpoints across the environment.

Root Cause

The root cause is improper certificate validation ([CWE-295]) on the SQL client connection established by the EPM Core. Without strict validation of the SQL server certificate, the client accepts attacker-supplied certificates or falls back to unencrypted transport, exposing the credential exchange to interception.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. The attacker must occupy a MITM position, such as through ARP spoofing on the local segment, rogue routing between VLANs, or compromise of an intermediary network device. Once positioned, the attacker passively captures the credential exchange or actively presents a forged certificate to complete the interception.

See the Ivanti Security Advisory - August 2026 for vendor technical details.

Detection Methods for CVE-2026-18129

Indicators of Compromise

Unexpected TLS certificate warnings or certificate authority changes on SQL traffic originating from the EPM Core host
ARP table anomalies on the network segment hosting the EPM Core or SQL server
SQL Server authentication events originating from IP addresses other than the known EPM Core host
Unusual query patterns against EPM databases outside of normal management windows

Detection Strategies

Inspect network traffic between the EPM Core and SQL backend for unencrypted TDS (Tabular Data Stream) packets or TLS sessions without validated certificate chains
Enable SQL Server auditing to log successful and failed logins from the EPM service account and alert on source-IP deviations
Correlate certificate change events, ARP anomalies, and SQL authentication logs in a centralized data lake to surface MITM activity

Monitoring Recommendations

Monitor the EPM Core host for outbound SQL sessions and verify that all sessions negotiate TLS with a trusted certificate
Alert on new devices appearing on the EPM management VLAN and on gateway MAC address changes
Track use of the EPM SQL service account outside of the Core server and rotate the credential if anomalous use is observed

How to Mitigate CVE-2026-18129

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU7 or later as specified in the vendor advisory
Rotate all SQL credentials used by the EPM Core after patching, assuming prior exposure
Restrict network paths between the EPM Core and the SQL backend to dedicated, monitored segments

Patch Information

Ivanti addressed CVE-2026-18129 in Endpoint Manager 2024 SU7. Administrators should review the Ivanti Security Advisory - August 2026 for the exact patch package and validated upgrade path.

Workarounds

Enforce SQL Server-side encryption with a certificate issued by a trusted internal certificate authority and require encrypted connections
Place the EPM Core and SQL backend on an isolated VLAN with strict access control lists to reduce MITM opportunities
Deploy network intrusion detection on the EPM management segment to surface ARP spoofing and rogue certificate presentation

bash

# Configuration example: enforce encrypted SQL connections on the client side
# Update the EPM Core SQL connection string to require encryption and
# validate the server certificate chain.
Server=sqlhost.example.local;Database=EPMDB;Encrypt=true;TrustServerCertificate=false;