CVE-2026-18129

Executive Summary

CVE-2026-18129 is a cleartext transmission vulnerability in the Core component of Ivanti Endpoint Manager (EPM) affecting all versions prior to 2024 SU7. A remote unauthenticated attacker in an adversary-in-the-middle (MITM) position can intercept network traffic and leak credentials used for external SQL connections. Successful exploitation results in full compromise of the confidentiality, integrity, and availability of the affected system, as reflected in the CVSS v3.1 base score of 8.1 (High). The vulnerability requires no authentication but demands an active MITM position, which accounts for the High (H) complexity score in the CVSS vector.

At the time of this report, no patch has been confirmed available, no public exploit code exists, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations running Ivanti EPM versions prior to 2024 SU7 should treat their deployments as compromised until patched and should prioritize network-level protections.

Technical Analysis

The vulnerability resides in the Core component of Ivanti Endpoint Manager. Based on the NVD description, the flaw is categorized as CWE-295: Improper Certificate Validation. This classification indicates that the affected component fails to properly validate TLS/SSL certificates when establishing outbound connections to external SQL databases.

Vulnerability Mechanism

Ivanti EPM's Core component maintains connections to external SQL database servers for configuration storage, inventory aggregation, and reporting functions. When establishing these connections, the Core component does not enforce proper certificate validation. This allows an attacker positioned on the network path between the EPM Core server and the external SQL database to present a fraudulent certificate that the client accepts without verification.

Because the connection is established without proper certificate trust verification, the TLS session can be transparently intercepted. The attacker can then decrypt the traffic and extract credentials that the EPM Core uses to authenticate to the SQL database. The NVD description explicitly states that this allows "leaking credentials for external SQL connections."

Attack Surface

The attack surface is the network path between two distinct infrastructure components:

1. Ivanti EPM Core server — the client side that initiates the SQL connection
2. External SQL database — the server-side endpoint that the Core connects to

The term "external" in the description indicates the SQL database is not co-located with the Core server but is reachable over the network, making the connection susceptible to interception. This is a common deployment pattern in enterprise environments where centralized SQL infrastructure serves multiple applications.

Technical Limitations

The NVD description provides no specific function names, code paths, or configuration parameters affected. The vulnerability class (CWE-295) suggests the issue lies in the TLS client implementation within the Core component, but insufficient technical detail is available to identify specific code-level defects. The failure could stem from:

• Disabled certificate validation in the SQL client library
• Acceptance of self-signed certificates without user confirmation
• Missing hostname verification against presented certificates
• Use of an inherently insecure connection method (e.g., plaintext TCP 1433/5432) that is not protected by TLS at all

Given that the description references "cleartext transmission," it is plausible that the connection may not use TLS at all in some configurations, or that TLS is used but certificate validation is ineffective, effectively making it cleartext from a security standpoint.

Exploitation Scenarios

No public proof-of-concept (PoC) is currently available. The attack chain described below is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance / Target Identification

An attacker first identifies an Ivanti EPM deployment. This can be accomplished through:

• Network scanning for typical EPM management ports (e.g., 443, 8080, or the LANDesk management agent ports)
• Shodan/Censys queries for exposed management consoles
• Internal network reconnaissance after initial foothold establishment
• Passive traffic analysis to identify periodic SQL traffic patterns from EPM Core servers to database infrastructure

The attacker must also identify the external SQL database endpoint that the EPM Core communicates with. This is typically accomplished by observing network flows or examining configuration files if prior access has been achieved.

Step 2: Triggering the Vulnerability

The attacker positions themselves on the network path between the EPM Core server and the external SQL database. This MITM position can be achieved through:

• ARP spoofing on the local network segment
• DNS poisoning to redirect the SQL hostname resolution
• BGP hijacking for cross-segment attacks
• Compromising a network appliance (switch, router, firewall) on the path

Once positioned, the attacker waits for the EPM Core to initiate a new SQL connection. Because the Core fails to properly validate certificates (CWE-295), the attacker intercepts the TLS handshake and presents a fraudulent certificate. The Core accepts this certificate and establishes a session through the attacker's interception point.

If the connection is truly cleartext (no TLS), the attacker simply sniffs the authentication exchange (e.g., SQL Server login packets or PostgreSQL authentication messages) directly from the wire.

Step 3: Credential Interception

The attacker captures the authentication exchange between the EPM Core and the SQL database. This exchange contains the SQL account username and password (or password hash with older authentication protocols). Depending on the database type and authentication mechanism:

• Microsoft SQL Server: The TDS login7 packet contains username and password (potentially obfuscated but recoverable)
• PostgreSQL: The authentication request/response exchange carries the password (MD5-hashed in older protocols, plaintext with password auth method)
• MySQL: The handshake protocol includes password authentication data that can be replayed or cracked

The attacker extracts and stores these credentials for later use.

Step 4: Post-Exploitation Impact

With the captured SQL credentials, the attacker can:

1. Directly access the SQL database — query, modify, or exfiltrate configuration data, inventory records, patches, and compliance data maintained by EPM
2. Lateral movement — if the SQL account has elevated privileges (e.g., sa on SQL Server), the attacker may leverage database features (xp_cmdshell, CLR assemblies, linked servers) to achieve code execution on the database server
3. Privilege escalation within EPM — database-stored credentials (e.g., domain accounts stored in EPM's SQL database) can be harvested and used to compromise additional systems
4. Availability impact — the attacker can drop or corrupt tables, disrupting EPM functionality and patch management operations across the entire managed fleet

The CVSS vector reflects this full impact: C:H/I:H/A:H — High confidentiality impact (credential theft and data exfiltration), High integrity impact (database modification), and High availability impact (disruption of EPM operations).

Impact Assessment

Business Impact

Ivanti Endpoint Manager is a comprehensive endpoint management platform used for patch management, software distribution, asset inventory, and compliance reporting across enterprise fleets. Compromise of its underlying SQL database credentials carries outsized risk because:

1. Credential reuse: The SQL account may be reused across other internal services or may have elevated privileges within the database instance hosting multiple applications
2. Endpoint visibility: EPM contains detailed inventory of all managed endpoints including OS versions, installed software, network configurations — prime targeting data for attackers
3. Patch management disruption: Attackers who can manipulate the EPM database can push malicious "patches" to thousands of endpoints or suppress legitimate patches, creating persistent compromise opportunities
4. Compliance impact: Organizations subject to regulatory requirements (PCI DSS, HIPAA, SOX) may face reporting obligations for credential exposure incidents

Affected Systems

All Ivanti Endpoint Manager deployments running versions prior to 2024 SU7 in configurations where the Core component connects to an external (remote) SQL database are affected. Deployments with SQL databases co-located on the same host or connected via isolated, physically secured network segments have reduced (but not eliminated) exposure.

CVSS Rationale

• Attack Vector: Network — the attacker exploits the vulnerability remotely over the network
• Attack Complexity: High — requires a MITM position, which demands successful network interception techniques
• Privileges Required: None — no pre-authentication is needed
• User Interaction: None — no user action triggers or mitigates the exploit
• Impact: High/High/High — full C/I/A impact on the affected system

The overall score of 8.1 places this vulnerability in the High severity band, reflecting the critical nature of credential leakage despite the elevated attack complexity.

Detection Guidance

Sigma Rule

title: Ivanti EPM Core Cleartext SQL Connection Attempt
id: 3f2a7c91-4e8b-4d5a-9c1f-2e6d8a0b4e7f
status: experimental
description: Detects cleartext SQL connection attempts from Ivanti EPM Core indicating potential CVE-2026-18129 exploitation
author: Valtersit Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1557
  - attack.command-and-control
  - cve.2026-18129
logsource:
  product: windows
  service: sysmon
detection:
  selection_network:
    EventID: 3
    DestinationPort:
      - 1433
      - 5432
      - 3306
    Image|endswith:
      - '\LDClient.exe'
      - '\LDMain.exe'
      - '\LdUnixAgent.exe'
    Initiated: 'true'
  selection_tls:
    EventID: 3
    Image|endswith:
      - '\LDClient.exe'
      - '\LDMain.exe'
    DestinationPort: 443
    Initiated: 'true'
  filter_legit:
    DestinationIp:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_network and not filter_legit
falsepositives:
  - Legitimate EPM Core to database connections over standard ports
level: medium

YARA Rule

rule CVE_2026_18129_Ivanti_EPM_SQL_Cleartext
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Ivanti EPM configuration files referencing cleartext or non-TLS SQL connection strings"
        cve = "CVE-2026-18129"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18129"
        severity = "high"
    strings:
        $sql_srv = "1433" ascii wide nocase
        $sql_pg = "5432" ascii wide nocase
        $sql_my = "3306" ascii wide nocase
        $conn_str = "Data Source" ascii wide nocase
        $tcp_str = "tcp:" ascii wide nocase
        $nonssl = "Encrypt=False" ascii wide nocase
        $noverify = "TrustServerCertificate=True" ascii wide nocase
        $cleartext = "cleartext" ascii wide nocase
        $plain = "password=" ascii wide nocase
        $epm_core = "Core" ascii wide nocase
        $inputid = "ConnectionString" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and 2 of them
        and ($conn_str or $inputid)
        and ($tcp_str or $sql_srv or $sql_pg or $sql_my)
        and ($nonssl or $noverify or $cleartext)
}

Suricata IDS Rule

alert tcp any any -> any 1433 (msg:"CVE-2026-18129 - Ivanti EPM Cleartext SQL Traffic to MSSQL"; flow:to_server,established; content:"|04|"; depth:1; content:"|01 00|"; within:4; content:"login"; nocase; within:20; content:"!|24|login"; distance:0; metadata:created_at 2026_01_01, updated_at 2026_01_01; reference:cve,2026-18129; classtype:attempted-user; sid:9000129; rev:1;)

alert tcp any any -> any 5432 (msg:"CVE-2026-18129 - Ivanti EPM Cleartext SQL Traffic to PostgreSQL"; flow:to_server,established; content:"p|00|"; depth:4; content:"user"; nocase; within:20; content:"password"; nocase; within:20; metadata:created_at 2026_01_01, updated_at 2026_01_01; reference:cve,2026-18129; classtype:attempted-user; sid:9000130; rev:1;)

alert tcp any any -> any 3306 (msg:"CVE-2026-18129 - Ivanti EPM Cleartext SQL Traffic to MySQL"; flow:to_server,established; content:"|0a|"; depth:1; content:"mysql_native_password"; nocase; within:30; content:"Secure Connection"; nocase; distance:0; metadata:created_at 2026_01_01, updated_at 2026_01_01; reference:cve,2026-18129; classtype:attempted-user; sid:9000131; rev:1;)

Elastic Detection

// Detect network connections from Ivanti EPM processes to SQL ports without TLS
network where process.name in ("LDClient.exe", "LDMain.exe", "LdUnixAgent.exe")
  and destination.port in (1433, 5432, 3306)
  and network.direction == "outbound"
  and event.action in ("connection_attempted", "connection_accepted")
  and not (
    source.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
    and destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  )

Splunk SPL Query

index=netflow OR index=network sourcetype=Flow
| where dest_port IN (1433, 5432, 3306)
| search src_ip IN (ivanti_epm_servers)
| table _time, src_ip, dest_ip, dest_port, bytes_out, bytes_in, protocol
| eval phase=case(
    dest_port==1433 OR dest_port==5432 OR dest_port==3306, "cleartext_sql",
    dest_port==443 AND protocol=="tcp", "tls_sql")
| search phase=cleartext_sql
| stats count by src_ip, dest_ip, dest_port
| where count > 5
| eval confidence="medium"
| table _time, src_ip, dest_ip, dest_port, count, confidence

Wazuh OSSEC Rule

<group name="ivanti_epm,">
  <rule id="120101" level="10">
    <decoded>json</decoded>
    <field name="process" type="string">\.*(LDClient|LDMain|LdUnixAgent)\.exe</field>
    <field name="dest_port" type="string">^(1433|5432|3306)$</field>
    <field name="dest_ip" type="ipv4">!10\.0\.0\.0/8,!172\.16\.0\.0/12,!192\.168\.0\.0/16</field>
    <description>Ivanti EPM Core attempting cleartext SQL connection - CVE-2026-18129</description>
    <mitre>
      <id>T1557.001</id>
      <killchain>Adversary-in-the-Middle:LLMNR/NBT-NS Poisoning and SMB Relay</killchain>
    </mitre>
    <group>cve_2026_18129,</group>
  </rule>

  <rule id="120102" level="8">
    <decoded>json</decoded>
    <field name="process" type="string">\.*(LDClient|LDMain|LdUnixAgent)\.exe</field>
    <field name="dest_port" type="string">^443$</field>
    <field name="tls_version" type="string">^(1\.0|1\.1)$</field>
    <description>Ivanti EPM Core using obsolete TLS version - possible CVE-2026-18129 exposure</description>
    <group>cve_2026_18129,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source at the time of this writing. The vendor (Ivanti) has not published an official advisory, and no fix has been confirmed available. The NVD description references "Ivanti Endpoint Manager before version 2024 SU7" as affected, implying that 2024 SU7 is the first patched release. Until that update is confirmed available and verified by the vendor, the vulnerability must be treated as unpatched.

Immediate Mitigations (no patch available)

1. Network segmentation: Isolate the EPM Core server and all external SQL database traffic onto a dedicated, physically or logically isolated management VLAN. Restrict access to this segment to only authorized administrative workstations.

2. Encrypted tunneling: Force all SQL traffic between EPM Core and external databases through a mandatory encrypted tunnel (IPsec VPN, WireGuard, or SSH tunneling). This neutralizes the MITM attack vector regardless of the application-layer cleartext vulnerability.

3. Certificate pinning / validation enforcement: If the EPM Core configuration permits disabling certificate validation, verify that all SQL connection strings specify Encrypt=True (SQL Server) or equivalent TLS parameters for the database in use. Manually import the legitimate database server certificate into the Core server's trusted root store and remove any self-signed certificates that might be present.

4. Network monitoring: Deploy passive TLS inspection on the network segment between EPM Core and SQL databases. Alert on any plaintext SQL port traffic or TLS sessions using weak (1.0/1.1, RSA key exchange) protocols.

5. Strong database credentials: Rotate all SQL credentials used by EPM immediately. Implement 30-day credential rotation cycles until the patch is applied. Use dedicated, least-privileged SQL accounts for EPM with no cross-service reuse.

Patch / Upgrade Steps

1. Monitor Ivanti security advisories for official confirmation of 2024 SU7 (or later) release notes referencing CVE-2026-18129.
2. Before patching, review current EPM version and verify upgrade path compatibility with your environment.
3. Schedule the upgrade during a maintenance window — EPM Core upgrades typically require service interruption.
4. Test the upgrade in a staging environment that mirrors your SQL connectivity architecture.
5. After upgrading to 2024 SU7 (or later), verify that SQL connections now enforce certificate validation and that MITM interception attempts fail.
6. Rotate SQL credentials again after patching to ensure no intercepted credentials retain validity.

Long-Term Hardening

1. Adopt certificate lifecycle management: Deploy an internal PKI with automated certificate issuance/renewal for all SQL database servers. Ensure the same CA is trusted by the EPM Core server.

2. Enable TLS 1.2+ exclusively: Disable TLS 1.0/1.1 on all database servers and the EPM Core. Enforce modern cipher suites (AES-GCM, ChaCha20) only.

3. Implement database-side access controls: Configure SQL databases to accept connections only from the EPM Core server's IP address via firewall rules or database-level IP allowlists. This limits the blast radius of any leaked credentials.

4. Alerting and logging: Enable SQL Server auditing (or equivalent for your DB engine) to log all authentication attempts. ETL these logs into your SIEM and alert on authentication from unexpected source IPs.

5. Network architecture review: Migrate to co-hosted SQL instances where feasible, or ensure SQL traffic traverses only trusted, physically secured network segments. Implement 802.1X network access control to prevent rogue device insertion.

6. Credential vaulting: Store SQL credentials in a vault service (HashiCorp Vault, CyberArk) and retrieve them at runtime via API, avoiding static credentials in EPM configuration files.

7. Continuous vulnerability monitoring: Subscribe to Ivanti security advisories and set up automated CVE monitoring (e.g., via NVD API) for this CVE ID to receive immediate notification when patch evidence becomes available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18129 — Official NVD record with the vulnerability description, CVSS vector, and CWE classification.

2. Ivanti Security Advisory (expected): https://www.ivanti.com/support/security-advisories — Ivanti's security advisory portal; watch for the official announcement of CVE-2026-18129 and the 2024 SU7 patch release notes.

3. CWE-295 Reference: https://cwe.mitre.org/data/definitions/295.html — MITRE CWE entry for Improper Certificate Validation, the vulnerability class underlying this CVE.

4. CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CISA KEV catalog entry; currently NO listing for CVE-2026-18129. Recheck periodically as exploitation status may change.

5. ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/ — MITRE ATT&CK technique mapping for the MITM positioning required to exploit this vulnerability.

Threat Actor Campaigns: No known threat actor campaigns have been publicly attributed to CVE-2026-18129 at the time of writing. No exploit-in-the-wild evidence has been reported. The absence of exploit code and the High attack complexity (MITM requirement) suggest that exploitation is currently limited to sophisticated, well-positioned adversaries (e.g., nation-state actors or advanced penetration testing teams with prior network access). Continuous monitoring of threat intelligence feeds is recommended as the vulnerability is expected to draw exploitation interest once the 2024 SU7 patch becomes publicly available, creating an opportunity window for attackers targeting unpatched systems.