CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
Description
CVE-2026-1603 is a HIGH authentication bypass vulnerability in Ivanti Endpoint Manager (EPM), carrying a CVSS 3.1 score of 8.6. The vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms and leak stored credentials from affected Ivanti EPM instances prior to the 2024 SU5 update. The flaw involves weaknesses in both authentication bypass using an alternate path (CWE-288) and missing authentication for critical function (CWE-306). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-03-09 with a remediation deadline of 2026-03-23. With an EPSS score of 0.457 (45.7%), this vulnerability has a high probability of exploitation and requires urgent remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager | < 2024; 2024 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel / CWE-306: Missing Authentication for Critical Function
CVE-2026-1603 is classified under CWE-288 — Authentication Bypass Using an Alternate Path or Channel, and CWE-306 — Missing Authentication for Critical Function. CWE-288 occurs when a system provides an alternative authentication path that does not enforce the same security controls as the primary mechanism, allowing attackers to bypass authentication entirely. CWE-306 occurs when a critical function lacks any authentication check, exposing it to unauthenticated access.
In the context of Ivanti Endpoint Manager, an enterprise endpoint management platform used to deploy software, manage patches, and configure devices across large organizations, authentication bypass vulnerabilities are extraordinarily dangerous. Ivanti EPM servers store and manage credentials used for deploying agents, accessing managed endpoints, and integrating with directory services. An authentication bypass that leaks stored credentials provides an attacker with the keys to an organization's endpoint management infrastructure, enabling widespread lateral movement, mass malware deployment, and potentially complete compromise of all managed endpoints.
Impact Analysis
CVE-2026-1603 carries a CVSS 3.1 score of 8.6 (HIGH) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Confidentiality (HIGH): The primary impact is credential leakage. An unauthenticated attacker can extract stored credentials from the Ivanti EPM server, which may include service account passwords, deployment credentials, database connection strings, and directory service integration credentials. These credentials typically have broad access across the managed environment.
Integrity (NONE): The vulnerability as scored does not directly enable data modification. However, the leaked credentials can be used in follow-on attacks that have devastating integrity impacts across the entire managed endpoint fleet.
Availability (NONE): The vulnerability does not directly impact service availability.
Scope Changed (S:C): This is a critical aspect of the scoring. The Changed scope indicates that exploitation of Ivanti EPM impacts resources beyond the EPM server itself. Leaked credentials can be used to compromise managed endpoints, directory services, and other systems that trust those credentials. The blast radius extends to every system managed by or connected to the compromised EPM instance.
Exploit Maturity
CVE-2026-1603 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog as of 2026-03-09.
Exploit status: The vulnerability is actively exploited, with the EPSS score of 45.7% confirming significant exploitation activity. Ivanti products have been repeatedly targeted by advanced threat actors, including state-sponsored groups. Authentication bypass vulnerabilities in endpoint management platforms are among the most sought-after initial access vectors due to the breadth of access they provide.
Ransomware association: Endpoint management platforms like Ivanti EPM are high-value targets for ransomware operators. The ability to extract stored credentials and leverage the EPM infrastructure for mass deployment makes this vulnerability class particularly attractive for large-scale ransomware campaigns. Historical attacks against similar management tools have resulted in organization-wide ransomware deployments.
Attack surface: Any Ivanti Endpoint Manager instance prior to the 2024 SU5 update that is network-accessible is vulnerable. The unauthenticated nature means no credentials are needed to initiate the attack. Many EPM servers are accessible from broad network segments to enable endpoint management across the organization.
KEV deadline: CISA has set a remediation deadline of 2026-03-23. Given the credential leakage capability and the Changed scope extending impact to all managed endpoints, this deadline should be treated as a maximum — earlier remediation is strongly recommended.
Remediation
- Apply Ivanti EPM 2024 SU5 immediately. Update all Ivanti Endpoint Manager instances to the 2024 SU5 release or later. This is the vendor-provided fix for the authentication bypass vulnerability.
- Restrict network access to EPM servers. Implement strict network segmentation and access controls for Ivanti EPM management interfaces. Only authorized administrator workstations should be able to reach the EPM console. Remove any unnecessary internet exposure.
- Rotate all credentials stored in and accessible from Ivanti EPM. Assume that any credentials stored within Ivanti EPM — including service accounts, deployment credentials, database passwords, and directory service integration credentials — may have been compromised. Rotate all affected credentials immediately.
- Audit managed endpoints for signs of compromise. Given that leaked EPM credentials provide access to managed endpoints, conduct a thorough investigation across the managed device fleet. Look for unauthorized software installations, configuration changes, unexpected agent behavior, and lateral movement indicators.
- Review Ivanti EPM access logs. Examine server logs for unauthenticated access attempts, unusual API calls, and credential retrieval activity. Identify any potential exploitation that occurred before the patch was applied.
- Implement enhanced monitoring on EPM infrastructure. Deploy additional logging and alerting for authentication events, credential access, and administrative operations on Ivanti EPM servers. Monitor for anomalous behavior that could indicate ongoing or follow-on exploitation using leaked credentials.
Technical Details
CVE-2026-1603 is a HIGH-severity authentication bypass vulnerability in Ivanti Endpoint Manager that enables unauthenticated credential leakage. The vulnerability is remotely exploitable over the network with low attack complexity. No authentication or user interaction is required.
Technical mechanism: Ivanti EPM prior to the 2024 SU5 update contains endpoints or paths that either lack authentication enforcement entirely (CWE-306) or can be accessed through an alternate path that bypasses the normal authentication mechanism (CWE-288). By exploiting these weaknesses, an unauthenticated attacker can access functionality that returns stored credentials from the EPM database. These credentials are used by EPM for managing endpoints, deploying software, and integrating with enterprise services such as Active Directory.
CVSS 3.1 vector analysis (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N): The Network attack vector reflects that EPM management interfaces are typically network-accessible. Low complexity indicates the authentication bypass is straightforward. No privileges or user interaction are required. The Changed scope (S:C) is the defining characteristic — leaked credentials impact systems far beyond the EPM server itself. Confidentiality is HIGH due to credential exposure, while Integrity and Availability are not directly affected by the vulnerability itself (though follow-on attacks using leaked credentials can have full CIA impact).
Affected versions: Ivanti Endpoint Manager before the 2024 SU5 update.
Frequently Asked Questions
What is CVE-2026-1603?
CVE-2026-1603 is a HIGH-severity (CVSS 8.6) authentication bypass vulnerability in Ivanti Endpoint Manager (EPM) that allows unauthenticated attackers to leak stored credentials. The vulnerability involves both missing authentication for critical functions and an alternate authentication bypass path. It is actively exploited and listed in CISA's KEV catalog.
Which versions of Ivanti EPM are affected?
Ivanti Endpoint Manager versions prior to the 2024 SU5 update are affected. Organizations should update to the 2024 SU5 release or later to address this vulnerability.
How do I fix CVE-2026-1603?
Update Ivanti EPM to the 2024 SU5 release or later immediately. After patching, rotate all credentials stored in and accessible from the EPM server, restrict network access to the management interface, and audit managed endpoints for signs of compromise using potentially leaked credentials.
How severe is CVE-2026-1603?
CVE-2026-1603 is rated HIGH with a CVSS score of 8.6 and an EPSS score of 45.7%. The Changed scope means leaked credentials can impact all systems managed by Ivanti EPM, not just the EPM server itself. It is actively exploited and has a CISA KEV remediation deadline of 2026-03-23. The credential leakage capability makes this particularly dangerous for organizations with large managed endpoint fleets.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.