ACTIEF MISBRUIKT
CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
| Leverancier | Ivanti |
|---|---|
| Product | Endpoint Manager (EPM) |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 9 mrt 2026 |
| CISA-deadline (Amerikaanse overheid) | 23 mrt 2026 |
| Zwakte (CWE) | CWE-288 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.
BRONNEN
Andere lekken bij Ivanti
- CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.