CVE-2026-1603: Ivanti Endpoint Manager authentication bypass leaks stored credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is a pre-auth remote authentication bypass leaking stored credentials, listed in CISA KEV with a very high EPSS score, so exploitation is known and impact is significant.

What it is

Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CWE-288/CWE-306) that lets a remote, unauthenticated attacker reach a function that leaks specific stored credential data. Because the flaw requires no credentials or user interaction and exposes secrets, it is a serious pre-auth information disclosure in an endpoint management platform.

Impact

An attacker gains access to stored credential data held by Endpoint Manager, which can enable lateral movement or further compromise of managed endpoints and connected systems. The flaw is confidentiality-only; there is no reported integrity or availability impact.

Attack surface

Reachable over the network via an alternate path that skips authentication, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Listed in CISA KEV (added 2026-03-09, due 2026-03-23), indicating known exploitation in the wild, and EPSS is very high at 0.8056 (99.6th percentile). No ransomware campaign use is documented.

What to do

• Upgrade Ivanti Endpoint Manager to 2024 SU5 or later; this is the primary fix.
• If immediate patching is not possible, apply the mitigations in Ivanti's February 2026 security advisory or discontinue use of the product per CISA BOD 22-01 guidance.
• Restrict network access to Endpoint Manager management interfaces to trusted hosts or management networks.
• Rotate or review credentials stored in Endpoint Manager, since the flaw leaks stored credential data.
• Monitor for and investigate any unauthorized access to EPM services before patching completes.

Detection

• Review EPM server and web logs for unauthenticated requests to endpoints or paths that should require authentication.
• Alert on anomalous access to credential or secret retrieval functions within Endpoint Manager.
• Hunt for outbound connections from the EPM server to unexpected destinations that could indicate exfiltration of leaked credentials.
• Correlate EPM access logs with authentication logs to find sessions that retrieved data without a corresponding login.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.