Cleartext Transmission Flaw in Ivanti Endpoint Manager Exposes Sensitive Data
CVE-2026-18128

6.8MEDIUM

Key Information:

Vendor

Ivanti
Status
Endpoint Manager
Vendor
CVE Published:
10 November 2026

What is CVE-2026-18128?

A security vulnerability exists in Ivanti Endpoint Manager versions prior to 2024 SU8 that allows remote attackers to intercept and potentially alter HTTP traffic. This cleartext transmission exposes sensitive information, making it susceptible to man-in-the-middle attacks. Attackers positioned to eavesdrop on network traffic can exploit this flaw to read and manipulate data, compromising the integrity and confidentiality of communications.

Affected Version(s)

Endpoint Manager 2024 SU8

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.