CVE-2026-1603 Ivanti Endpoint Manager (EPM) Authentication Bypass
Remote unauthenticated attackers can bypass authentication to leak stored credential data in Ivanti Endpoint Manager.
- Exploited in the wild
- Since 9 Mar 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1603?
CVE-2026-1603 is a high-severity authentication bypass vulnerability in Ivanti Endpoint Manager, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
Which versions are affected by CVE-2026-1603?
It affects 1 product.
Products include Ivanti Endpoint Manager.
How do I fix CVE-2026-1603?
No fix has been published for CVE-2026-1603 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Mar 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-1603 being exploited?
Yes. Attackers have exploited CVE-2026-1603 in the wild since at least 9 Mar 2026.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Ivanti Endpoint Manager
- CVE-2024-13159 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-13160 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-13161 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-29824 Ivanti Endpoint Manager (EPM) SQL Injection
- CVE-2024-29847 Deserialization in EPM
Sources
Also known as GHSA-2j3g-j6qj-x9q2.