{"id":"CVE-2026-18127","aliases":["EUVD-2026-56157","GHSA-9vrc-hrp5-9j72"],"status":"published","title":"External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7...","description":"External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00721,"percentile":0.54419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-73"],"published":"2026-08-11T14:23:45Z","modified":"2026-10-23T19:10:00Z","products":[{"vendor":"ivanti","product":"endpoint manager"}],"references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-August-2026"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18127"},{"url":"https://github.com/advisories/GHSA-9vrc-hrp5-9j72"}],"sources":{"cve":[{"id":"CVE-2026-18127","description":"External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.","status":"published","published":"2026-08-11T14:23:45.537Z","modified":"2026-08-11T14:49:59.092Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-56157","description":"External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.","status":"published","published":"2026-08-11T14:23:45Z","modified":"2026-08-11T14:49:59Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:59.926728Z"}],"ghsa":[{"id":"GHSA-9vrc-hrp5-9j72","title":"External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7...","description":"External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.","status":"published","published":"2026-08-11T15:32:44Z","modified":"2026-08-11T15:32:51Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:10:17.573081Z"}],"nvd":[{"id":"CVE-2026-18127","description":"External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.","status":"published","published":"2026-08-11T15:17:28.193Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:12:36.499002Z"}]}}