Cleartext transmission of sensitive information in Endpoint Manager - CVE-2026-18128
Published: November 10, 2026
Vulnerability identifier: #VU164592
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18128
CWE-ID: CWE-319
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read sensitive information and modify HTTP traffic.
The vulnerability exists due to cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager when communicating over HTTP. A remote attacker can intercept communications from a man-in-the-middle position to read sensitive information and modify HTTP traffic.
Affected software
Endpoint Manager
How to mitigate CVE-2026-18128
Install security update from vendor's website.
Endpoint Manager - update to 2024 SU8