CVE-2026-18127 is an S3 object key injection vulnerability in Ivanti Endpoint Manager's session recording feature. An authenticated user can supply arbitrary filenames that flow directly into S3 put-object calls, granting write access to the recording bucket. The critical insight isn't the injection itself — it's that this bucket stores privileged admin sessions, not end-user recordings. You're not protecting generic file uploads; you're protecting years of IT administrator sessions containing typed credentials, internal system access, and crown-jewel activity.
The vulnerability stems from a pervasive mental model in cloud integrations: authenticated equals authorized for storage operations. Tutorials, SDK documentation, and stack overflow answers consistently scope S3 access to "authenticated users" without modeling what happens when an attacker already satisfies that condition. This is the same bug class as CVE-2019-7653 (Docker), CVE-2021-22291 (GitLab), and CVE-2022-42889 (Wildfly) — user-controlled input flowing into storage API key parameters without application-mediated authorization. The pattern recurs because the canonical answer to "how do you let users name stored objects without giving them path control" never got taught or documented at scale.
What you should do now: First, determine whether your Ivanti EPM deployment uses a customer-managed S3 bucket or Ivanti's infrastructure — this affects who controls the bucket policy and what configuration options you have. Second, check the retention policy on the recording bucket. If it holds months or years of admin sessions, the exposure window isn't just the time between disclosure and patch — it's the entire operational lifespan of the feature. Third, audit existing S3 objects for integrity. A patch doesn't restore corrupted recordings or deletetampered evidence. Fourth, assume this vulnerability was exploitable for years before disclosure — any authenticated insider or credential-compromised account during that window had write access to privileged session data. Rotate any admin credentials that appeared in recordings during the likely exposure period. The CVSS score doesn't capture the compound nature of this exposure: it's not a single event but a persistent, longitudinal compromise of your audit infrastructure until forensic work closes it.