ACTIVELY EXPLOITED
CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
| Vendor | Ivanti |
|---|---|
| Product | Endpoint Manager (EPM) |
| Actively exploited | Yes |
| Added to CISA KEV | 9 Mar 2026 |
| CISA federal deadline | 23 Mar 2026 |
| Weakness (CWE) | CWE-288 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.
SOURCES
Other Ivanti flaws
- CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.