CVE-2026-1603

View on CVE.org
Published Feb 10, 2026 CVSS 3.1 · 8.6 High EPSS 88.3% KEV · Listed
Description
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

Analysis

AI-generated

Technical impact

An authentication bypass in Ivanti Endpoint Manager, affecting all releases before 2024 SU5, permits a remote unauthenticated attacker to access and leak specific stored credential data. This weakness is manifested as Improper Authentication (CWE‑288) and Missing Authentication for Critical Operation (CWE‑306). The breach compromises confidentiality by exposing sensitive authentication information.

Affected Systems

Ivanti Endpoint Manager, all versions released prior to 2024 SU5, including the 2024 updates 2024 SU1 through 2024 SU4 and their security releases.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity, while an EPSS score of 88% signals a relatively high probability of exploitation. This vulnerability is listed in the CISA KEV catalog, indicating that active exploitation may already be occurring. Because the vulnerability allows remote unauthenticated access, an attacker can trigger a credential leak without needing valid credentials, so patching remains a priority.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Ivanti Endpoint Manager patch (2024 SU5) or any later version that addresses the authentication bypass bug.
  • Enforce multi‑factor authentication for all management interfaces to mitigate improper authentication weaknesses (CWE‑288).
  • Disable or remove default and unmanaged credentials, restricting API and remote access to internally trusted hosts (CWE‑306).
  • Continuously monitor authentication logs for abnormal credential export activity and investigate any anomalies promptly.

Generated by OpenCVE AI on September 24, 2026 at 19:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Authentication Bypass Allowing Credential Leak in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Allowing Credential Leak in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Allows Credential Leakage in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Allows Credential Leakage in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Enables Remote Credential Leak in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Enables Remote Credential Leak in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Allows Credential Leakage in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Allows Credential Leakage in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Exposes Stored Credentials in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Exposes Stored Credentials in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Allows Remote Credential Leakage in Ivanti Endpoint Manager
Type Values Removed Values Added
Title Authentication Bypass Allows Remote Credential Leakage in Ivanti Endpoint Manager
Type Values Removed Values Added
Weaknesses CWE-306
CPEs cpe:2.3:a:ivanti:endpoint_manager:2024:su4_sr1:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su4_security_release_1:*:*:*:*:*:*
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-03-09T00:00:00+00:00', 'dueDate': '2026-03-23T00:00:00+00:00'}
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager:2024:su1:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager:2024:su2:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager:2024:su3:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager:2024:su3_security_release_1:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager:2024:su4:*:*:*:*:*:*
cpe:2.3:a:ivanti:endpoint_manager:2024:su4_sr1:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Ivanti
Ivanti endpoint Manager
Vendors & Products Ivanti
Ivanti endpoint Manager
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}
Earlier changes (14)
Weaknesses
  • CWE-288

    Authentication Bypass Using an Alternate Path or Channel

  • CWE-306

    Missing Authentication for Critical Function

Sources

Status
PUBLISHED
Assigner
ivanti
Published
Updated
Mar 10, 2026, 3:55 AM
Reserved
Jan 29, 2026, 9:18 AM

View source JSON

Updated
Feb 10, 2026, 4:00 PM

JSON

Status
Analyzed
Published
Feb 10, 2026, 4:16 PM
Modified
Jun 17, 2026, 10:16 AM

View source JSON

No data.

Updated
Sep 24, 2026, 7:15 PM

JSON