CVE-2026-1603: Ivanti Endpoint Manager authentication bypass, unauthenticated credential-data leak
The short version: CVE-2026-1603 is an authentication-bypass flaw in Ivanti Endpoint Manager (EPM) that lets a remote, unauthenticated attacker leak specific stored credential data. It's a confidentiality-focused issue — no code execution and no data tampering — but the data it exposes is credentials, and it's in CISA's KEV catalog. If you run EPM, patch and rotate. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — unauthenticated disclosure of stored credential data |
| CVSS v3.1 (NVD) | 8.6 — High · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| EPSS | ~80.6% · 99.58th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-03-23 |
| Known exploited? | Yes — listed in CISA KEV |
| Vulnerability type | CWE-288 authentication bypass using an alternate path → leak of specific stored credential data |
| Requires authenticated session? | No — pre-authentication |
| Affected | Ivanti Endpoint Manager before version 2024 SU5 |
| Fixed in | EPM 2024 SU5 (and later) |
What you need to know
CVE-2026-1603 lets an unauthenticated attacker take an alternate path around the intended access checks and read specific stored credential data from the EPM server. The CVSS vector is telling: confidentiality is High, but integrity and availability are None — this bug reads secrets, it doesn't run code or alter data.
- How they find it — internet-wide scanning surfaces exposed Ivanti EPM servers; version fingerprinting flags builds below 2024 SU5.
- How they use it — an unauthenticated request retrieves stored credential data the server holds.
- What it leads to — leaked credentials are the raw material for follow-on access: reuse against other systems, or a step toward escalating on the EPM environment itself, which manages your endpoint fleet.
A note on our source data: an internal definition described this as remote code execution. The authoritative record (the CVE and NVD) classifies it as an authentication bypass that leaks stored credential data, with no integrity or availability impact — that's what we've written to here.
How serious we see it
Critical — serious because of what leaks, bounded because of what it can't do.
An unauthenticated attacker reading credential data from an internet-facing management server is a real problem, and its KEV listing confirms it's being used — so this isn't a low rating. It stays at High rather than Critical because the flaw itself is disclosure-only: it doesn't execute code or modify data, and the follow-on damage depends on where those leaked credentials are still valid. The reassuring part is that it's narrow and fixable: one supported build closes it, and rotating the exposed credentials removes the payoff.
Recommendations
Straight from Ivanti's advisory and CISA:
- Patch now. Upgrade to EPM 2024 SU5 or later.
- Rotate the exposed credentials. Assume the stored credential data leaked and reset it, along with anything that reused it.
- Hunt for follow-on use. Review authentication logs for reuse of those credentials from unexpected sources.
- Harden exposure. Restrict who can reach the EPM server; keep it off the public internet where possible.
- Confirm your exposure first. Verify whether you run an EPM build below 2024 SU5.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Ivanti EPM servers, fingerprints the product and version, and flags exposure tied to KEV-listed vulnerabilities like this one — surfaced at the top of your results because it's in KEV. This is version-based discovery and flagging; BreachRisk maps the exposed, affected server rather than extracting credentials from it.
That continuous, attacker's-eye view keeps a management server that quietly faces the internet on your radar before its stored secrets become someone else's.