CVE-2026-1603

A flaw in Ivanti Endpoint Manager lets attackers without permission access stored passwords and login credentials by bypassing the authentication system. This is dangerous because attackers can use these stolen credentials to access other systems and accounts.

An authentication bypass vulnerability in Ivanti Endpoint Manager versions prior to 2024 SU5 allows unauthenticated remote attackers to retrieve sensitive credential data. The vulnerability stems from improper authentication validation (CWE-288) and requires network access to the vulnerable endpoint, potentially enabling lateral movement and privilege escalation.