CVE-2026-1603 Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Exploitation active constatée

· catalogue CISA KEV

Action attendue Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Campagnes de rançongiciel Non constatée à ce jour

Faiblesse CWE-288

Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Endpoint Manager	Versions non publiées

Autres CVE de Endpoint Manager

Les 71 CVE de Endpoint Manager →

CVE-2026-18129 Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows… 8.1 Élevée CVE-2026-18127 External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote… 7.7 Élevée CVE-2026-18125 An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote… 7.5 Élevée CVE-2026-8111 SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated… 8.8 Élevée