CVE-2026-1603

What it actually does

This is a remote, unauthenticated authentication-bypass vulnerability in Ivanti Endpoint Manager before 2024 SU5 that can allow an attacker to access and leak specific stored credential data without valid login credentials or user interaction. The CVSS vector indicates network exploitability, low attack complexity, no privileges required, no user interaction, changed scope, and high confidentiality impact, with no direct integrity or availability impact described. The primary technical risk is exposure of credentials managed or stored by the EPM platform, which can then be reused against managed systems, administrative services, service accounts, or downstream infrastructure.

Why it matters to the business

Successful exploitation can expose sensitive operational credentials used to manage endpoints, creating a serious risk of follow-on compromise even if the vulnerability itself is limited to data leakage. Because Ivanti Endpoint Manager is commonly used for endpoint administration, stolen credentials may enable attackers to move from the management plane into broader IT infrastructure, disrupt endpoint operations, access sensitive systems, or prepare later ransomware or extortion activity. This vulnerability is listed in CISA KEV, has reported active exploitation in the wild, and has a high EPSS score, so organizations should treat internet-exposed or broadly reachable EPM instances as urgent remediation targets. The CISA remediation due date is 2026-03-23. The supplied fixed-version metadata also references a Linux stable git commit, but that package information does not align with the Ivanti EPM vulnerability description; remediation should be validated against the authoritative Ivanti advisory for EPM.

How an attack unfolds

An attacker first identifies an exposed or reachable Ivanti Endpoint Manager instance running a vulnerable version before 2024 SU5. Because the flaw is an authentication bypass, the attacker does not need valid credentials and does not need to trick a user. The attacker sends crafted requests to the vulnerable EPM service path or API behavior that incorrectly permits access to protected credential-related data. If successful, the attacker obtains stored credential material or credential-derived information. The attacker may then test those credentials against EPM itself, managed endpoints, domain services, administrative shares, remote management interfaces, package distribution mechanisms, or other internal services. While the vulnerability’s direct impact is confidentiality, the leaked credentials can become the starting point for privilege escalation, lateral movement, persistence, data theft, or operational disruption.

How to fix it

Upgrade Ivanti Endpoint Manager to 2024 SU5 or later using Ivanti’s official guidance and confirm that all EPM core servers, consoles, and related components are brought to a fixed level. If immediate upgrade is not possible, restrict access to EPM management interfaces to trusted administrative networks, VPNs, or jump hosts; block internet exposure; enforce network segmentation between EPM and non-administrative networks; monitor and limit service-account privileges; and rotate credentials that may be stored in or accessible through EPM. Because this vulnerability can leak stored credentials, remediation should include credential rotation for accounts managed by or stored within EPM, especially domain, local administrator, deployment, database, service, and software-distribution credentials. Review whether any vulnerable instances were exposed before patching and conduct compromise assessment before assuming patching alone is sufficient. The supplied package fixed-version data references org/pub/scm/linux/kernel/git/stable/linux.git fixed in commit 0a71344f99289250e4d5b8adbac76f444485c840; this appears inconsistent with the Ivanti EPM description and should not be used as the sole remediation source for EPM unless confirmed by the vendor or asset owner.

How to confirm the fix worked

Confirm the installed Ivanti Endpoint Manager version is 2024 SU5 or later on every EPM server and related administrative component. Validate through the product console, installed package inventory, vendor-supported version commands, and centralized asset inventory. Run an authenticated vulnerability scan or configuration compliance check that specifically verifies the vulnerable EPM build is no longer present. Confirm EPM administrative interfaces are not exposed to the public internet unless explicitly required and protected by compensating controls. Review firewall, reverse proxy, and load balancer rules to ensure only approved administrative sources can reach EPM services. After upgrading, test that unauthenticated requests to protected credential-related functionality are rejected with expected authentication or authorization failures. Validate that stored credentials and service accounts have been rotated where exposure is plausible, and confirm no unexpected authentication using old credentials remains possible.

Typical attack path

1. Scan for Ivanti Endpoint Manager instances exposed to the internet, partner networks, VPN-accessible segments, or internal management networks.
2. Fingerprint the target to determine whether it is running a vulnerable release before Ivanti Endpoint Manager 2024 SU5.
3. Send unauthenticated crafted requests that trigger the authentication-bypass condition.
4. Retrieve specific stored credential data or credential-related secrets exposed by the vulnerable functionality.
5. Validate whether the leaked credentials work against EPM, managed endpoints, directory services, remote administration services, or other internal systems.
6. Use valid credentials for follow-on access, lateral movement, privilege escalation, data collection, or staging of additional tooling.
7. Attempt to clear logs, blend activity into normal administrative traffic, or maintain access using newly obtained credentials.

How to detect it

Investigate whether vulnerable Ivanti Endpoint Manager systems received unauthenticated or suspicious requests before patching, especially from external IP addresses, VPN ranges, proxies, or hosts that do not normally administer EPM. Review EPM application logs, web server logs, reverse proxy and load balancer logs, Windows event logs on the EPM server, EDR telemetry, identity provider logs, VPN logs, directory-service authentication logs, and privileged account activity. Look for unauthenticated requests to protected management or credential-related functionality, unusual HTTP status patterns such as successful responses without a prior authenticated session, spikes in requests to EPM administrative paths, access by rare user agents, and requests from IPs not associated with administrators. Correlate any suspicious EPM access with later successful logins by EPM-managed service accounts, local administrator accounts, domain accounts, deployment accounts, or other credentials stored in EPM. Pay special attention to logins from new hosts, impossible travel, unusual protocols such as SMB/RDP/WinRM/LDAP, new scheduled tasks, remote service creation, credential dumping alerts, and privilege changes after the suspected EPM access. Because public reporting in the supplied data does not provide a specific exploit URI, payload, file artifact, process name, or malware family, detection should emphasize behavior-based correlation rather than a single static IOC.

What your security team should do

• Prioritize patching to Ivanti Endpoint Manager 2024 SU5 or later because the vulnerability is in CISA KEV, has active exploitation reported, and has a high EPSS score.
• Immediately identify all Ivanti Endpoint Manager instances, including internet-facing, VPN-accessible, disaster-recovery, lab, and legacy servers.
• Remove direct internet exposure and restrict EPM access to approved administrative networks or jump hosts while remediation is underway.
• Perform credential rotation for accounts stored in, managed by, or used by EPM, especially privileged service accounts and endpoint administrator credentials.
• Conduct a retrospective compromise assessment for the period before patching, focusing on unauthenticated access patterns and subsequent use of credentials associated with EPM.
• Review EPM, web server, reverse proxy, endpoint, identity provider, VPN, EDR, and directory-service logs for suspicious access followed by successful authentications from unusual sources.
• Hunt for lateral movement from systems that accessed EPM shortly before using administrative credentials elsewhere.
• Increase monitoring on accounts historically used by EPM for unusual login locations, abnormal protocol use, new host access, privilege changes, and failed-then-successful authentication sequences.
• Track CISA KEV remediation requirements and complete remediation before the 2026-03-23 due date where applicable.
• Validate vendor advisory details because the supplied fixed-version package metadata appears inconsistent with the Ivanti EPM product description.