An authentication bypass in Ivanti Endpoint Manager, affecting all releases before 2024 SU5, permits a remote unauthenticated attacker to access and leak specific stored credential data. The breach compromises confidentiality by exposing sensitive authentication information.

Ivanti Endpoint Manager, all versions released prior to 2024 SU5, including the 2024 updates 2024 SU1 through 2024 SU4 and their security releases.

The CVSS score of 8.6 indicates high severity, and an EPSS score of 0.55% indicates a very low likelihood of exploitation. Listed in the CISA Known Exploited Vulnerabilities catalog, the issue has been monitored for active exploitation. Because the vulnerability allows remote unauthenticated access, an attacker can trigger a credential leak without needing valid credentials, but the low EPSS suggests current exploitation is unlikely, so assessment of risk should be balanced against patching priorities.