CVE-2026-18128 · Vendor
NO FIX YET · SEE WHAT TO DO
The Agent component of Ivanti Endpoint Manager before 2024 SU8 sends sensitive information over cleartext HTTP. An attacker in a man-in-the-middle position on the network can read and modify that traffic.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running Ivanti Endpoint Manager with the Agent installed on endpoints before 2024 SU8. Exposure depends on an attacker being positioned on the network path between the agent and its server, so a segment the attacker cannot reach is lower risk. unknown beyond that.
Not affected if version-2024-su8-or-later
Who cares endpoint-manager, enterprise, ivanti, windows
2024 SU8 release in the vendor's notice; the sources do not give a check command.2024 SU8 or later, per the NVD entry; the sources do not state a patch link.Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.