CVE-2026-1603Ivanti Endpoint Manager authentication bypass leaks stored credentials
What broke
Ivanti Endpoint Manager (EPM) is an on-premises endpoint management server. NVD describes CVE-2026-1603 as "an authentication bypass in Ivanti Endpoint Manager before version 2024 SU5" that "allows a remote unauthenticated attacker to leak specific stored credential data." CISA records the weakness as authentication bypass using an alternate path or channel (CWE-288); NVD also lists missing authentication for a critical function (CWE-306). NVD scores it CVSS 3.1 7.5, and Ivanti's own score is 8.6. The fix is EPM 2024 SU5.
Ivanti disclosed it in its February 10, 2026 Patch Tuesday update, said it had no evidence of exploitation, and said no other Ivanti product was affected. That changed within a month: CISA added it to KEV on March 9, 2026, 27 days after disclosure. Neither NVD nor CISA says which stored credentials are exposed, so treat every secret EPM holds as in scope.
Why it matters
A systems management server holds the accounts it uses to reach every managed device, and those accounts are often administrators on the devices they manage. Reading them without logging in turns one unpatched console into credentials that work across the fleet. It belongs with the PAM and remote-access tools: like Quest KACE and Ivanti's own EPMM, the value is the standing access behind the login.
What to do
- Upgrade EPM to 2024 SU5 or later.
- Do not expose the EPM core server to the internet. Restrict its web services to managed networks and administrator subnets.
- Inventory every credential configured in EPM (the service accounts it uses to reach managed devices) and scope each to the fewest hosts and rights it needs.
After you patch
- If the core was reachable before you patched, rotate every credential stored in EPM, then review domain controller logs for those accounts authenticating from hosts other than the EPM server.
- Add the EPM service accounts to privileged access monitoring so later misuse stands out.
Sources
Related identity CVEs
Related on Start with Identity
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- CVEIvanti Connect Secure root escalation, the last link in the UTA0576 chain
The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched Oct
- CVEIvanti Connect Secure SAML SSRF, chained to auth bypass
SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CIS
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C