Enterprise software company Ivanti on Tuesday announced patches for four vulnerabilities in Endpoint Manager (EPM) and Neurons for MDM.
The EPM update addresses three high-severity bugs, including two that could be exploited by remote, unauthenticated attackers.
Tracked as CVE-2026-18129, the first is described as a cleartext transmission of sensitive information issue that can be exploited by an attacker in a man-in-the-middle (MitM) position to leak credentials for external SQL connections.
The second, CVE-2026-18125, is an out-of-bounds read flaw in the EPM agent that can be triggered to crash an agent service.
Both security defects were resolved in EPM version 2024 SU7, which also patches CVE-2026-18127, a high-severity input validation weakness that allows remote attackers to control filenames.
