CISA
CISA flags CVE-2026-1603 authentication bypass in Ivanti EPM
According to CISA, the Known Exploited Vulnerabilities (KEV) Catalog lists CVE-2026-1603, an Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data. The entry notes that this vulnerability is related to CWE-288 and asks organisations to apply mitigations per vendor instructions, follow relevant cloud-service guidance, or discontinue use of the product if mitigations are unavailable.
Date Added is 9 March 2026 and the Due Date is 23 March 2026. The catalog also states that the vulnerability is Known To Be Used in Ransomware Campaigns? Unknown. Links provided include advisories and CVE details for further context.
Story timeline CVE-2026-1603
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 11 Feb · 12:40 UTC | SecurityWeek | Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025 |
| Thu 12 Feb · 05:10 UTC | SecurityOnline | CVE-2026-1603: Remote Unauthenticated Attacker Can Steal Ivanti EPM Secrets |
| Thu 12 Feb · 06:50 UTC | Security Affairs | Multiple Endpoint Manager bugs patched by Ivanti, including remote auth bypass |
| Mon 9 Mar · 21:22 UTC | CISA | CISA Adds CVE-2026-1603 to KEV for Ivanti EPM Exploitation |
| Mon 9 Mar · 21:28 UTC | CISA | CISA flags CVE-2026-1603 authentication bypass in Ivanti EPM (this article) |
| Tue 10 Mar · 07:43 UTC | The Hacker News | CISA flags KEV amid active exploits CVE-2025-26399 CVE-2026-1603 |
| Tue 10 Mar · 10:49 UTC | Security Affairs | CISA Adds KEV Flaws CVE-2021-22054 CVE-2025-26399 CVE-2026-1603 |
| Tue 10 Mar · 12:21 UTC | SecurityWeek | CISA adds Ivanti CVE-2026-1603 auth bypass to KEV, patch now |