CVE-2026-1603

CVE-2026-1603 is an authentication bypass vulnerability affecting Ivanti Endpoint Manager versions prior to 2024 SU5. It enables a remote unauthenticated attacker to leak specific stored credential data, stemming from issues classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function). The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, no required privileges, and significant confidentiality impact across a changed scope.

A remote unauthenticated attacker can exploit this vulnerability over the network without user interaction by targeting the affected Endpoint Manager instance. Successful exploitation allows the attacker to access and leak specific stored credential data, potentially enabling further compromise such as lateral movement or privilege escalation within the environment, though it does not directly provide integrity or availability impacts.

Ivanti has published Security Advisory EPM-February-2026 detailing patches for Endpoint Manager 2024, recommending upgrade to version 2024 SU5 or later to mitigate the issue. The vulnerability is also listed in CISA's Known Exploited Vulnerabilities Catalog, urging federal agencies to apply mitigations immediately due to active exploitation.

This CVE has seen real-world exploitation, as evidenced by its inclusion in the CISA KEV catalog shortly after publication on 2026-02-10.