{"id":"CVE-2026-18128","kind":"vulnerability","aliases":["CVE-2026-18128"],"related":[],"title":"Ivanti Endpoint Manager Agent: cleartext traffic lets a network attacker read and change data","description":"Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.","summary":"The Agent component of Ivanti Endpoint Manager before 2024 SU8 sends sensitive information over cleartext HTTP. An attacker in a man-in-the-middle position on the network can read and modify that traffic.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoint-manager","enterprise","ivanti","vendor","windows"],"not_affected_if":["version-2024-su8-or-later"],"how_to_check":"- Check the installed Ivanti Endpoint Manager Agent version against the `2024 SU8` release in the vendor's notice; the sources do not give a check command.","fix":"- Move the Ivanti Endpoint Manager Agent to `2024 SU8` or later, per the NVD entry; the sources do not state a patch link.","status":"open","published_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:32+00:00","updated_at":"2026-11-10T16:23:32+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T16:23:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Ivanti Endpoint Manager Agent to `2024 SU8` or later, per the NVD entry; the sources do not state a patch link.","reach":"network","title":"Ivanti Endpoint Manager Agent: cleartext traffic lets a network attacker read and change data","impact":"medium","summary":"The Agent component of Ivanti Endpoint Manager before 2024 SU8 sends sensitive information over cleartext HTTP. An attacker in a man-in-the-middle position on the network can read and modify that traffic.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ivanti","endpoint-manager","windows","enterprise"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker reads and alters agent traffic on the network path","analyst_note":"Confirm the affected version range and the vendor advisory with the Ivanti security notice; the NVD text only gives the 2024 SU8 boundary.","how_to_check":"- Check the installed Ivanti Endpoint Manager Agent version against the `2024 SU8` release in the vendor's notice; the sources do not give a check command.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-2024-su8-or-later"],"who_is_affected":"Organizations running Ivanti Endpoint Manager with the Agent installed on endpoints before 2024 SU8. Exposure depends on an attacker being positioned on the network path between the agent and its server, so a segment the attacker cannot reach is lower risk. unknown beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4536,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18128':17A,20A '-2026':16A,19A '2024':36B,77C 'agent':4A,29B,70C 'allow':79C 'attack':10A,45B,83C 'chang':13A 'cleartext':5A,42B,63C 'compon':30B 'cve':15A,18A 'data':14A 'endpoint':2A,22B,33B,73C 'endpoint-manag':21B 'enterpris':24B 'http':43B,93C 'inform':40B,67C 'ivanti':1A,25B,32B,72C 'let':7A 'man':49B 'man-in-the-middl':48B 'manag':3A,23B,34B,74C 'middl':52B 'mitm':87C 'modifi':60B,92C 'network':9A,56B 'posit':53B,88C 'read':11A,58B,90C 'remot':81C 'send':38B 'sensit':39B,66C 'su8':37B,78C 'traffic':6A,62B,94C 'transmiss':64C 'unauthent':82C 'vendor':26B 'version':76C 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Ivanti Endpoint Manager with the Agent installed on endpoints before 2024 SU8. Exposure depends on an attacker being positioned on the network path between the agent and its server, so a segment the attacker cannot reach is lower risk. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpointmanager","enterprise","ivanti","medium","vendor","windows"],"campaign_type":null,"search_a":"'-18128':17A,20A '-2026':16A,19A 'agent':4A 'attack':10A 'chang':13A 'cleartext':5A 'cve':15A,18A 'data':14A 'endpoint':2A 'ivanti':1A 'let':7A 'manag':3A 'network':9A 'read':11A 'traffic':6A","search_b":"'2024':36B 'agent':29B 'attack':45B 'cleartext':42B 'compon':30B 'endpoint':22B,33B 'endpoint-manag':21B 'enterpris':24B 'http':43B 'inform':40B 'ivanti':25B,32B 'man':49B 'man-in-the-middl':48B 'manag':23B,34B 'middl':52B 'modifi':60B 'network':56B 'posit':53B 'read':58B 'send':38B 'sensit':39B 'su8':37B 'traffic':62B 'vendor':26B 'window':27B","search_c":"'2024':77C 'agent':70C 'allow':79C 'attack':83C 'cleartext':63C 'endpoint':73C 'http':93C 'inform':67C 'ivanti':72C 'manag':74C 'mitm':87C 'modifi':92C 'posit':88C 'read':90C 'remot':81C 'sensit':66C 'su8':78C 'traffic':94C 'transmiss':64C 'unauthent':82C 'version':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18128","severity":null,"published_at":"2026-11-10T16:17:24+00:00","modified_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}