# Ivanti Endpoint Manager authentication bypass leaks stored credentials

Source: https://startwithidentity.com/cves/cve-2026-1603/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

Ivanti Endpoint Manager (EPM) is an on-premises endpoint management server. NVD describes CVE-2026-1603 as "an authentication bypass in Ivanti Endpoint Manager before version 2024 SU5" that "allows a remote unauthenticated attacker to leak specific stored credential data." CISA records the weakness as authentication bypass using an alternate path or channel (CWE-288); NVD also lists missing authentication for a critical function (CWE-306). NVD scores it CVSS 3.1 7.5, and Ivanti's own score is 8.6. The fix is EPM 2024 SU5.

Ivanti disclosed it in its February 10, 2026 Patch Tuesday update, said it had no evidence of exploitation, and said no other Ivanti product was affected. That changed within a month: CISA added it to KEV on March 9, 2026, 27 days after disclosure. Neither NVD nor CISA says which stored credentials are exposed, so treat every secret EPM holds as in scope.

## Why it matters

A systems management server holds the accounts it uses to reach every managed device, and those accounts are often administrators on the devices they manage. Reading them without logging in turns one unpatched console into credentials that work across the fleet. It belongs with the PAM and remote-access tools: like [Quest KACE](https://startwithidentity.com/cves/cve-2025-32975/) and Ivanti's own [EPMM](https://startwithidentity.com/cves/cve-2023-35078/), the value is the standing access behind the login.

## What to do

- Upgrade EPM to 2024 SU5 or later.
- Do not expose the EPM core server to the internet. Restrict its web services to managed networks and administrator subnets.
- Inventory every credential configured in EPM (the [service accounts](https://startwithidentity.com/glossary/service-account/) it uses to reach managed devices) and scope each to the fewest hosts and rights it needs.

## After you patch

- If the core was reachable before you patched, rotate every credential stored in EPM, then review domain controller logs for those accounts authenticating from hosts other than the EPM server.
- Add the EPM service accounts to [privileged access](https://startwithidentity.com/guides/fundamentals/what-is-pam/) monitoring so later misuse stands out.

## Sources

- [NVD: CVE-2026-1603](https://nvd.nist.gov/vuln/detail/cve-2026-1603)
- [Ivanti Security Advisory EPM February 2026 for EPM 2024](https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US)
- [Ivanti: February 2026 Security Update](https://www.ivanti.com/blog/february-2026-security-update)
- [CISA Known Exploited Vulnerabilities catalog, added March 9, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1603)