Endpoint Manager
CVE-2026-1603
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request to Ivanti Endpoint Manager
-
ExploitBypass authentication mechanism
-
ExecutionAccess credential storage
-
ImpactExfiltrate stored credential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Ivanti Endpoint Manager versions before 2024 SU5. No special conditions — remote unauthenticated exploitation against default configurations accessible over network. |
| Impact | CVSS 8.6 (High). KEV-listed — actively exploited. EPSS 43.9% — high exploitation probability. No authentication required. Credential leakage enables cascading compromise. Stored credentials often have broad infrastructure access. |
| Exploit ScenarioDerived | An attacker discovers an internet-facing or network-accessible Ivanti EPM instance and exploits the authentication bypass to access the credential store. The stolen credentials — which may include Active Directory service accounts, database admin credentials, and deployment keys — are used to: access domain controllers, deploy ransomware across all managed endpoints, access databases, or establish persistent access through legitimate service accounts that are difficult to detect. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthenticated remote attackers to leak stored credential data. KEV-listed with EPSS 43.9%, this vulnerability exposes credentials stored in the endpoint management platform — potentially including service accounts, deployment credentials, and other secrets used to manage the entire endpoint fleet.
Earlier versions of this analysis (1)
Ivanti Endpoint Manager contains an authentication bypass via alternate path (CWE-288) that allows unauthenticated remote attackers to access and exfiltrate stored credentials from the endpoint management platform.
RemediationAI
Upgrade to Ivanti EPM 2024 SU5 or later immediately. After patching: rotate ALL credentials stored in EPM. Audit the use of stored service accounts for unauthorized activity. Restrict EPM access to management networks only. Monitor for credential abuse indicators.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ivanti Endpoint Manager (EPM) stores credentials used for deploying software, managing endpoints, and connecting to infrastructure services. The authentication bypass allows unauthenticated access to these stored credentials through an alternate API path that does not properly enforce authentication. EPM typically stores service account credentials, database connection strings, and deployment secrets that provide broad access to the managed environment.
Know when Endpoint Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
Zero Day Initiative Advisories
Executive ViewAI
An unauthenticated remote attacker can exploit a critical authentication bypass in Ivanti Endpoint Manager to steal stored credentials without a patch currently available. This poses an immediate risk to any organization running affected versions, as attackers are actively exploiting this vulnerability in the wild to compromise credential stores.
Implement network segmentation to restrict remote access to Ivanti Endpoint Manager; deploy WAF/IPS rules to block exploitation attempts targeting authentication endpoints; disable remote management features if operationally feasible; enforce VPN-only access with additional multi-factor authentication; implement enhanced logging and SIEM alerting for unauthorized credential access attempts; consider temporary failover to alternative endpoint management solutions if available.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Endpoint Manager
View allIvanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to l
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosu
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosur
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege es
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device r
Stored cross-site scripting in Ivanti Endpoint Manager (2024 releases through 2024 SU4, including SU1, SU2, SU3 and SU3
Remote code execution in Ivanti Endpoint Manager before version 2024 SU4 is achievable via a path-traversal flaw (CWE-22
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an aut
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allow
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unau
GitHub PoC
Exploit-DB