Enterprise software company Ivanti on Tuesday announced patches for four vulnerabilities in Endpoint Manager (EPM) and Neurons for MDM.
The EPM update addresses three high-severity bugs, including two that could be exploited by remote, unauthenticated attackers.
Tracked as CVE-2026-18129, the first is described as a cleartext transmission of sensitive information issue that can be exploited by an attacker in a man-in-the-middle (MitM) position to leak credentials for external SQL connections.
The second, CVE-2026-18125, is an out-of-bounds read flaw in the EPM agent that can be triggered to crash an agent service.
Both security defects were resolved in EPM version 2024 SU7, which also patches CVE-2026-18127, a high-severity input validation weakness that allows remote attackers to control filenames.
An authenticated threat actor could exploit the flaw to gain full write control over an S3 bucket configured for session recording storage.
“We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure,” Ivanti said.
Ivanti Neurons for MDM received fixes for a single medium-severity command-injection vulnerability that could be exploited remotely to disclose sensitive information.
The flaw was patched in version R124 of the cloud-based SaaS platform in late June and requires no customer action.
According to Ivanti, the issue “did not meet the criteria for reserving a CVE number” and there is no evidence that it has been exploited in the wild.
Ivanti says no other products are affected by these vulnerabilities. Additional information can be found in the company’s August 2026 security update announcement.
Related: SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform
Related: Cisco Patches Firewall Zero-Day Exploited for DoS Attacks
Related: SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities
Related: August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day