CVE DatabaseCVE-2026-1603

Updated 2026-06-17한국어 권고문 →

CVE-2026-16037.5/HIGHCISA KEVCWE-288CWE-306

Ivanti Endpoint Manager (EPM) Authentication Bypass and Credential Leak Vulnerability (CVE-2026-1603) Urgent Security Advisory

⚡ Jump to Patch

Affected Vendors

ivanti

Affected Components

endpoint manager

Published Date

2026-02-10

CVSS v3.1

7.5

HIGH

EPSS (30d)

88.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5

Impact

A remote unauthenticated attacker can bypass authentication to leak specific stored credential data, potentially leading to full infrastructure compromise

Mitigation

Immediately upgrade Ivanti EPM to version 2024 SU5 or later, and restrict external access to the management console

Affected Products & Version Scope

All Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5 (Fixed in 2024 SU5)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Administrators must immediately upgrade Ivanti EPM to version 2024 SU5 or later. Use the following PowerShell commands to verify the current installation path and version details of EPM components.

powershell

# Check the version of Ivanti EPM executables in the default installation directory
$EpmPath = 'C:\Program Files\LANDesk\ManagementSuite'
if (Test-Path $EpmPath) {
    Get-ItemProperty -Path "$EpmPath\*.exe" | Select-Object VersionInfo | Format-List
    Write-Host '[!] If the version is prior to 2024 SU5, apply the official patch immediately.' -ForegroundColor Yellow
} else {
    Write-Host '[+] Ivanti EPM is not detected in the default path.' -ForegroundColor Green
}

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to the EPM console and web services (ports 80, 443, etc.) using firewall rules to block all external traffic and allow only trusted administrative IP ranges.

powershell

# Block external access to EPM web services and allow only trusted internal subnets
New-NetFirewallRule -DisplayName 'Block-External-EPM-Access' -Direction Inbound -Action Block -Protocol TCP -LocalPort 443 -RemoteAddress Internet
New-NetFirewallRule -DisplayName 'Allow-Admin-EPM-Access' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 -RemoteAddress '10.0.0.0/8', '192.168.1.0/24'

3. Log Audit & IoC Verification Commands

Inspect IIS access logs for unauthorized requests (indicated by anonymous access '-' and HTTP status 200) targeting sensitive EPM endpoints.

bash

# Search IIS logs for unauthenticated access to potentially vulnerable endpoints
# Note: Adjust the log path and endpoint patterns according to your specific environment.
grep -i -E '/(WSVulnerabilityCore|Configuration|Credentials)' /inetpub/logs/LogFiles/W3SVC1/*.log | grep ' 200 ' | grep ' - '

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

This vulnerability is actively exploited in the wild (CISA KEV); immediately apply the Ivanti EPM 2024 SU5 patch to secure your environment.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-1603) is an authentication bypass and missing authentication flaw (CWE-306, CWE-288) in Ivanti Endpoint Manager (EPM). It resides in specific endpoints responsible for handling sensitive configuration and credential data. Due to insufficient access control validation, the application fails to properly verify the identity of the requesting party before exposing stored credentials.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated remote attacker can exploit this vulnerability by sending crafted HTTP requests directly to the vulnerable EPM server endpoints. Because the application does not enforce strict authentication checks on these specific paths, it processes the request and returns the requested credential data in the response. Attackers can leverage these leaked credentials to gain unauthorized access to other critical systems, move laterally within the network, or escalate privileges to domain administrator level.

3. Infrastructure & Business Impact

With a CVSS score of 7.5 (High) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability represents an active and severe threat. The EPSS score of 0.8833 indicates an extremely high probability of exploitation in the wild. Compromising an EPM server allows attackers to control the central management node, enabling them to deploy ransomware or malware to all managed endpoints, resulting in catastrophic business disruption.

Official Vendor Advisories & References

NVD Original English Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1603

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2026-1603)

FAQ

Q1. How critical is CVE-2026-1603 and is it actively exploited in the wild?

CVE-2026-1603 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 88.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2026-1603?

Primary impacted vendors include ivanti across endpoint manager. Scope summary: All Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5 (Fixed in 2024 SU5)

Q3. What temporary mitigations or workarounds exist for CVE-2026-1603 before patching?

[Mitigation] Immediately upgrade Ivanti EPM to version 2024 SU5 or later, and restrict external access to the management console Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION