CVE-2026-18127

Executive Summary

CVE-2026-18127 is a filename control vulnerability (CWE-73) in the Core component of Ivanti Endpoint Manager (EPM) affecting versions prior to 2024 SU7. A remote authenticated attacker can exploit this flaw to gain full write control over an S3 bucket configured for session recording storage, enabling unauthorized data manipulation, overwrite, or destruction of recorded session artifacts. The vulnerability carries a high CVSS score of 7.7 with significant integrity impact and no confidentiality or availability impact, and it is currently unpatched with no vendor fix, workaround, or public exploit available.

Technical Analysis

Vulnerability Class: CWE-73 — External Control of File Name or Path. This weakness occurs when an application uses user-controlled input to construct a file name or path without sufficient sanitization or validation, permitting an attacker to influence file operations beyond the intended scope.

Affected Component: The Core module of Ivanti Endpoint Manager (EPM), which serves as the central management server for endpoint devices. The Core orchestrates device management, patch distribution, configuration enforcement, and — critically for this vulnerability — the storage of session recording artifacts.

Vulnerable Functionality: Session recording is a security and compliance feature within EPM that captures administrative or user sessions (e.g., remote support, privileged access). These recorded sessions are stored in an S3 bucket, which is a cloud object storage service. The filename used to store or reference these session recordings is, according to the NVD description, subject to external control by an authenticated attacker.

Attack Surface: The vulnerability is remotely exploitable over the network (AV:N) but requires a valid account with access to the EPM Core interface (PR:L — low privileges required). The attack does not require user interaction (UI:N). The scope is changed (S:C), meaning the compromise extends beyond the vulnerable component's security authority — specifically, it impacts the S3 bucket resource.

Mechanism: An authenticated attacker can manipulate the filename parameter used during session recording storage operations. Because the application does not properly validate or constrain this input, the attacker can specify arbitrary filenames (e.g., using path traversal sequences like ../ or absolute paths) that reference objects within the configured S3 bucket. The result is full write control over the S3 bucket contents — the attacker can create, overwrite, rename, or delete arbitrary objects.

CVSS Rationale (as provided): The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N produces a base score of 7.7. The high integrity impact (I:H) reflects the attacker's ability to tamper with or destroy stored session recordings. The confidentiality and availability impacts are scored as None, indicating the attack vector does not directly expose data or disrupt service availability in itself, although full write control over the bucket could lead to indirect consequences.

Exploitation Scenarios

No public PoC or exploit code is available for this vulnerability ("PoC/Exploit: UNKNOWN | Exploit Code: NO"). The attack chain described below is inferred from the vulnerability class (CWE-73) and the NVD description.

Step 1 — Reconnaissance and Target Identification: An attacker with valid but low-privileged credentials (e.g., a helpdesk user or an endpoint operator account) identifies the EPM Core server as a management interface. Network scanning or Shodan dorking for Ivanti EPM management consoles exposes reachable instances. The attacker authenticates to the web interface or management API using their low-privilege credentials.

Step 2 — Triggering the Filename Control Flaw: The attacker navigates to the session recording management feature. When triggering a session recording retrieval, download, or storage operation, the attacker intercepts the request and modifies the filename parameter. The injection payload at the vulnerability-class level consists of path traversal sequences or absolute paths (e.g., ../../../../bucket-root/other-file.mp4) to redirect the file write operation to an unintended location within the S3 bucket.

Step 3 — Payload Execution: Because the EPM Core fails to sanitize the filename, the application interprets the attacker-supplied path as the target object key within the S3 bucket. The attacker can then:

• Overwrite existing session recordings with arbitrary content (destroying forensic evidence or audit trails).
• Create new objects with misleading names to inject false session records.
• Delete critical bucket objects (if the write operation supports deletion semantics).

Step 4 — Post-Exploitation Impact: The attacker gains full write control over the S3 bucket used for session recording storage. This enables tampering with compliance records, covering tracks of malicious activity, or injecting forged session data. The scope change (S:C) means the attacker's influence extends beyond the EPM Core application itself into the external cloud storage infrastructure.

Impact Assessment

Business Impact:

• Integrity (HIGH): Session recordings are often mandatory for compliance regimes (e.g., PCI DSS, SOX, HIPAA for privileged access). An attacker with write control over this storage can alter or destroy audit evidence, potentially enabling fraud or hiding unauthorized activity.
• Regulatory Risk: Inability to prove the integrity of session recordings undermines compliance attestation and may trigger regulatory fines or audit findings.
• Forensic Blindness: If session recordings are overwritten or deleted, incident response teams lose critical evidence during future investigations.

Affected Systems:

• All Ivanti Endpoint Manager deployments running versions prior to 2024 SU7 that use S3-compatible storage for session recording.
• Organizations using EPM in hybrid or fully cloud-hosted environments where the S3 bucket is external to the EPM server itself.

Blast Radius: The scope change (S:C) indicates the security impact crosses trust boundaries — the exploitation reaches the S3 bucket, which may store records for multiple tenants, sites, or business units managed by a single EPM Core. The attacker's write capability is not limited to the application's own data but extends to the entire bucket namespace, amplifying the potential damage.

CVSS Interpretation: Score 7.7 (High) results from the combination of network exploitability, low authentication barrier, high integrity impact, and scope change. The absence of confidentiality impact mitigates direct data theft, but integrity compromise of audit data is often considered more damaging for compliance-driven organizations.

Detection Guidance

Sigma Rule

title: Ivanti EPM Session Recording Filename Manipulation
id: 1c4a8f2e-9d3b-4b7a-8e1f-2a5c9d0e3b61
status: experimental
description: Detects suspicious filename manipulation in Ivanti EPM session recording operations, potentially indicating CVE-2026-18127 exploitation.
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
    product: ivanti
    category: endpoint_manager
detection:
    selection_session:
        EventID: 'recording_operation'
    selection_filename:
        filename|contains:
            - '../'
            - '..\\'
            - '/'
            - '\\'
        filename|endswith:
            - '.mp4'
            - '.avi'
            - '.log'
            - '.session'
    selection_bucket:
        bucket_name|startswith: 'session-recording'
    condition: selection_session and selection_filename and selection_bucket
falsepositives:
    - Legitimate use of subdirectories in bucket filenames (rare)
    - Approved filename modifications by authorized administrators
level: high

YARA Rule

rule Ivanti_EPM_SessionRecording_FilenameTraversal
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects log entries or files indicating filename traversal in Ivanti EPM session recording storage"
        reference = "CVE-2026-18127"
        date = "2026-01-01"
        cvss = "7.7"
        cwe = "CWE-73"
    strings:
        $path_traversal1 = "../" ascii
        $path_traversal2 = "..\\" ascii
        $path_traversal3 = "%2e%2e%2f" ascii  // URL-encoded ../ 
        $path_traversal4 = "%2e%2e%5c" ascii  // URL-encoded ..\
        $session_key = "session-recording" ascii nocase
        $bucket_op = "PutObject" ascii nocase
        $bucket_op2 = "CopyObject" ascii nocase
        $bucket_op3 = "DeleteObject" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize < 10MB
        and 2 of ($path_traversal*)
        and ($session_key or 1 of ($bucket_op*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"IVANTI-EPM CVE-2026-18127 Session Recording Filename Traversal Attempt"; flow:established,to_server; content:"session"; http_uri; nocase; content:"recording"; http_uri; nocase; content:"../"; http_uri; nocase; content:"bucket"; http_uri; nocase; pcre:"/(session-recording|\/recordings\/).*(\.\.\/|\.\.\\)/Ui"; classtype:attempted-admin; reference:cve,2026-18127; sid:1001827; rev:1;)

Elastic Detection

// EQL query for Elastic Security
sequence by host.name, user.name with maxspan=5m
  [authentication where process.name : "ivanti*" and outcome == "success"]
  [file where event.action in ("create", "write", "modify", "delete") and 
     file.name : ("*\.\./*", "*\.\.\\*") or 
     file.path : ("*session*", "*recording*") and
     file.path : ("*..\\*", "*../*")]
  [network where destination.port == 443 and process.name : "ivanti*"]

Splunk SPL Query

index=ivanti_epm earliest=-7d
| search (source="*recording*" OR sourcetype="*session*" OR event_id="recording_operation")
| where match(file_name, "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)")
  OR match(bucket_key, "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)")
| stats count by user, src_ip, file_name, bucket_name, _time
| sort - _time
| rename user as "Authenticated User", src_ip as "Source IP", 
         file_name as "Requested Filename", bucket_name as "Target Bucket"
| table _time, "Authenticated User", "Source IP", "Requested Filename", "Target Bucket", count

Wazuh OSSEC Rule

<group name="ivanti_epm,">
  <rule id="100827" level="12">
    <decoded_as>json</decoded_as>
    <field name="product">ivanti_endpoint_manager</field>
    <field name="event_type">recording</field>
    <regex>\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c</regex>
    <description>Ivanti EPM: Session recording filename traversal detected - CVE-2026-18127</description>
    <group>attack.t1190,attack.impact</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status

CRITICAL: Patch confidence is 0/4 — the vulnerability is UNPATCHED. No vendor fix, no patch evidence from any tracked source, and no workarounds have been published. The release of Ivanti Endpoint Manager 2024 SU7 is referenced in the NVD description as the version in which the vulnerability is addressed, but this update has not been formally confirmed or released as of this report.

Immediate Mitigations (compensating controls):

1. Restrict S3 Bucket Permissions: Apply minimum-privilege IAM policies on the S3 bucket used for session recordings. Remove the default write permission granted to the EPM service account. Isolate the bucket from the EPM Core's direct write access where possible.
2. Network Segmentation: Place the EPM Core behind a firewall or WAF that filters requests containing path traversal patterns (../, ..\, URL-encoded equivalents) before they reach the application.
3. Access Control Review: Audit and revoke unnecessary low-privilege accounts that have access to the EPM Core interface. Enforce MFA for all EPM administrative accounts.
4. Monitoring: Deploy the detection rules above (Sigma, YARA, Suricata, etc.) to identify and alert on exploitation attempts in real time.

Patch/Upgrade Steps:

1. Monitor Ivanti's official security advisory channels (https://www.ivanti.com/support/advisories) for the release of EPM 2024 SU7.
2. Upon release, test the upgrade in a staging environment that mirrors production configuration (including S3 storage).
3. Perform a full backup of the EPM Core database and configuration before applying the upgrade.
4. Deploy EPM 2024 SU7 to production after successful validation.
5. Verify S3 bucket access and session recording functionality post-upgrade.

Long-Term Hardening:

1. Input Validation: Implement strict allow-listing for filename parameters in web forms and API endpoints. Reject any input containing path separators, traversal sequences, or absolute path notation.
2. S3 Bucket Policy Hardening: Use S3 Object Ownership and bucket policies that restrict object writes to expected prefixes only. Enable S3 Versioning and Object Lock to prevent overwrites/deletions, preserving audit trails even under compromise.
3. Integrity Monitoring: Enable S3 server access logging and CloudTrail data events for the session recording bucket. Configure alerts for anomalous write patterns.
4. Credential Rotation: Rotate the credentials used by the EPM Core to access S3 storage regularly and after any suspected compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18127 — National Vulnerability Database entry containing the official CVE description and CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, score 7.7).
2. Ivanti Security Advisories Portal: https://www.ivanti.com/support/advisories — Vendor advisory page to monitor for the release of EPM 2024 SU7 and official patch announcement.
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — Relevant ATT&CK technique for exploitation of internet-facing management interfaces.
4. MITRE CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html — Weakness class reference providing context on the vulnerability mechanism.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Note: CVE-2026-18127 is NOT listed; no in-the-wild exploitation has been confirmed by CISA as of the report date.

Report metadata: Generated by ValtersIT Threat Intelligence. Date: 2026-01-01. Status: UNPATCHED. Exploit availability: NONE PUBLIC. External campaigns observed: NONE. This report is based exclusively on the CVE intelligence data provided; no technical details beyond the NVD description were available, and no specific function names, endpoints, or parameter names have been fabricated.