What is CVE-2026-1603?

CVE-2026-1603 is a HIGH-severity (CVSS 8.6) authentication bypass vulnerability in Ivanti Endpoint Manager (EPM) that allows unauthenticated attackers to leak stored credentials. The vulnerability involves both missing authentication for critical functions and an alternate authentication bypass path. It is actively exploited and listed in CISA's KEV catalog.

Which versions of Ivanti EPM are affected?

Ivanti Endpoint Manager versions prior to the 2024 SU5 update are affected. Organizations should update to the 2024 SU5 release or later to address this vulnerability.

How do I fix CVE-2026-1603?

Update Ivanti EPM to the 2024 SU5 release or later immediately. After patching, rotate all credentials stored in and accessible from the EPM server, restrict network access to the management interface, and audit managed endpoints for signs of compromise using potentially leaked credentials.

How severe is CVE-2026-1603?

CVE-2026-1603 is rated HIGH with a CVSS score of 8.6 and an EPSS score of 45.7%. The Changed scope means leaked credentials can impact all systems managed by Ivanti EPM, not just the EPM server itself. It is actively exploited and has a CISA KEV remediation deadline of 2026-03-23. The credential leakage capability makes this particularly dangerous for organizations with large managed endpoint fleets.

CVE-2026-1603

HIGH(8.6)KEVLikely Exploited

Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

KEV Information

Vendor

Ivanti

Product

Endpoint Manager (EPM)

Date Added

March 9, 2026

Due Date

March 23, 2026

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NOpen in Calculator

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

4.0

CWEs

CWE-288

CWE-306Missing Authentication

Missing Authentication for Critical Function

Affected Products

Vendor	Product	Version
ivanti	endpoint manager	< 2024; 2024

Multiple CVSS Assessments

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75(Secondary)

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Source: [email protected](Primary)

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1603(US Government Resource)

CVSS Score

8.6

HIGH(8.6)

EPSS Score

EPSS Score80.56%

EPSS Percentile99.6%

Dates

PublishedFebruary 10, 2026

Last ModifiedJune 17, 2026

StatusAnalyzed

CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch

CVE-2026-1603

Description

KEV Information

CVSS Score

CWEs

Affected Products

Multiple CVSS Assessments

References

CVSS Score

EPSS Score

Dates

Quick Links

Need Help With Vulnerability Management?

Platform

Resources

Company

Latest Articles