In CISA KEV8.6 HighCWE-288
CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
Ivanti Endpoint Manager (EPM)
Status
- Exploited in the wild
- In CISA KEV since 9 Mar
- Vendor fix available
Federal deadlineMon 23 Mar, 23:59 UTC
Passed 215 days ago
CISA KEV · added 9 Mar
Exploit probabilityEPSSchecked 25 Oct
88%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
8.6High
Description NVD
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 8 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 11 Feb · 12:40 UTC | SecurityWeek | Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025 |
| Thu 12 Feb · 05:10 UTC | SecurityOnline | CVE-2026-1603: Remote Unauthenticated Attacker Can Steal Ivanti EPM Secrets |
| Thu 12 Feb · 06:50 UTC | Security Affairs | Multiple Endpoint Manager bugs patched by Ivanti, including remote auth bypass |
| Mon 9 Mar · 21:22 UTC | CISA | CISA Adds CVE-2026-1603 to KEV for Ivanti EPM Exploitation |
| Mon 9 Mar · 21:28 UTC | CISA | CISA flags CVE-2026-1603 authentication bypass in Ivanti EPM |
| Tue 10 Mar · 07:43 UTC | The Hacker News | CISA flags KEV amid active exploits CVE-2025-26399 CVE-2026-1603 |
| Tue 10 Mar · 10:49 UTC | Security Affairs | CISA Adds KEV Flaws CVE-2021-22054 CVE-2025-26399 CVE-2026-1603 |
| Tue 10 Mar · 12:21 UTC | SecurityWeek | CISA adds Ivanti CVE-2026-1603 auth bypass to KEV, patch now |
- CISA adds Ivanti CVE-2026-1603 auth bypass to KEV, patch nowSecurityWeek
- CISA Adds KEV Flaws CVE-2021-22054 CVE-2025-26399 CVE-2026-1603Security Affairs · mentions it in passing
- CISA flags KEV amid active exploits CVE-2025-26399 CVE-2026-1603The Hacker News · mentions it in passing
- CISA flags CVE-2026-1603 authentication bypass in Ivanti EPMCISA · official notice
- CISA Adds CVE-2026-1603 to KEV for Ivanti EPM ExploitationCISA · official notice
- Multiple Endpoint Manager bugs patched by Ivanti, including remote auth bypassSecurity Affairs
- CVE-2026-1603: Remote Unauthenticated Attacker Can Steal Ivanti EPM SecretsSecurityOnline
- Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025SecurityWeek · first in our coverage