CVE-2026-1603: high-severity vulnerability in Ivanti Endpoint Manager
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Ivanti Endpoint Manager lets attackers without permission access stored passwords and login credentials by bypassing the authentication system. This is dangerous because attackers can use these stolen credentials to access other systems and accounts.
An authentication bypass vulnerability in Ivanti Endpoint Manager versions prior to 2024 SU5 allows unauthenticated remote attackers to retrieve sensitive credential data. The vulnerability stems from improper authentication validation (CWE-288) and requires network access to the vulnerable endpoint, potentially enabling lateral movement and privilege escalation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.