What is the CVSS score of CVE-2026-1603?

CVE-2026-1603 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 43.9%.

Which versions of Endpoint Manager are affected by CVE-2026-1603?

An unauthenticated remote attacker can exploit a critical authentication bypass in Ivanti Endpoint Manager to steal stored credentials without a patch currently available.

Is there a public PoC exploit available for CVE-2026-1603?

Yes, a public proof-of-concept exploit is available for CVE-2026-1603. Prioritise patching immediately. EPSS: 43.9%.

How to fix or mitigate CVE-2026-1603?

Within 24 hours: Identify all Ivanti Endpoint Manager instances and their versions; isolate systems running versions prior to 2024 SU5 from direct internet exposure. Within 7 days: Deploy network segmentation to restrict access to affected systems, implement enhanced monitoring for suspicious authentication attempts, and contact Ivanti support for patch availability timeline. Within 30 days: Upgrade to Ivanti Endpoint Manager 2024 SU5 or later; conduct a credential audit to identify and rotate any potentially compromised credentials stored in affected systems.

Endpoint Manager CVE-2026-1603

HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-02-10 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Ivanti Authentication Bypass Endpoint Manager

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

Added to CISA KEV

Mar 10, 2026 - 13:11 cisa

CISA KEV

CVE Published

Feb 10, 2026 - 16:16 nvd

HIGH 8.6

DescriptionCVE.org

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

AnalysisAI

Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthenticated remote attackers to leak stored credential data. KEV-listed with EPSS 43.9%, this vulnerability exposes credentials stored in the endpoint management platform — potentially including service accounts, deployment credentials, and other secrets used to manage the entire endpoint fleet.

Technical ContextAI

Ivanti Endpoint Manager (EPM) stores credentials used for deploying software, managing endpoints, and connecting to infrastructure services. The authentication bypass allows unauthenticated access to these stored credentials through an alternate API path that does not properly enforce authentication. EPM typically stores service account credentials, database connection strings, and deployment secrets that provide broad access to the managed environment.

RemediationAI

Upgrade to Ivanti EPM 2024 SU5 or later immediately. After patching: rotate ALL credentials stored in EPM. Audit the use of stored service accounts for unauthorized activity. Restrict EPM access to management networks only. Monitor for credential abuse indicators.