CVE-2026-1603

Analyzed
Published: 10 Feb 2026, 15:09
Last modified:10 Mar 2026, 03:55

Vulnerability Summary

Overall Risk (default)
medium
46/100
CVSS Score
8.6 HIGH
v3.1 (cve.org)
EPSS Score
57.91% CRITICAL
58% probability -7.48%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Feb 2026, 15:09
Published
Vulnerability first disclosed
09 Mar 2026, 00:00
Added to CISA KEV
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
10 Mar 2026, 03:55
Last Modified
Vulnerability information updated
23 Mar 2026, 00:00
CISA Remediation Due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

CVSS Metrics

  • v3.1•HIGH•Score: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 57.91%• Percentile: 98%

Techniques & Countermeasures

  • CWE-288•Authentication Bypass Using an Alternate Path or Channel

    The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  • CWE-306•Missing Authentication for Critical Function

    The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected Systems

  • ivanti•endpoint_manager

    2024:su4_sr1 | < 2024 | 2024 | 2024:su1 | 2024:su2 | 2024:su3 | 2024:su3_security_release_1 | 2024:su4 | 2024:su4_security_release_1

References (2)