CISA: Ivanti EPM auth bypass CVE-2026-1603 exploited, agencies given two weeks

CISA has added CVE-2026-1603, an authentication bypass in Ivanti Endpoint Manager (EPM), to its Known Exploited Vulnerabilities catalog. An unauthenticated attacker who can reach the EPM core server can retrieve stored credential data. EPM manages software and configuration across thousands of endpoints and holds privileged credentials to do it, so a leak from that server is a short path to wider compromise.

What happened

Ivanti fixed CVE-2026-1603 in its February 2026 EPM security advisory (published 11 February), which shipped EPM 2024 SU5. Ivanti rates it CVSS 8.6 (High) and describes it as an authentication bypass through an alternate path or channel. It lets a remote, unauthenticated attacker with network access to the core server read stored credential material with no user interaction. The same release fixed CVE-2026-1602 (CVSS 6.5), a SQL injection that lets an authenticated attacker read arbitrary data from the database, along with 11 medium-severity issues first disclosed in October 2025.

When it released the patch, Ivanti said it knew of no exploitation. On 9 March 2026 CISA added CVE-2026-1603 to the KEV catalog based on evidence of active exploitation, and gave federal civilian agencies until 23 March 2026 to remediate. That's two weeks, shorter than the usual three-week window. CISA added two other bugs the same day: CVE-2021-22054, an SSRF in Omnissa Workspace ONE UEM, and CVE-2025-26399, a SolarWinds Web Help Desk RCE.

Earlier reports described CVE-2026-1603 as a cross-site scripting flaw with a three-week deadline. Ivanti's advisory and CISA's catalog entry don't support either claim.

Who is affected

• Ivanti EPM 2024 SU4 SR1 and earlier (all versions before 2024 SU5). EPM was formerly sold as LANDesk Management Suite.
• The core server and remote consoles. Ivanti says EPM agents don't contain the vulnerability, and Cloud Service Appliance deployments aren't affected.
• Organizations whose EPM core server is reachable from the internet, or from large user networks, face the highest risk because only network access is needed.

What it means for developers and engineering teams

"Alternate path" authentication bypasses (CWE-288) usually happen when one route to a resource enforces login and another doesn't. Typical examples are a legacy API, an internal service endpoint or a handler the auth middleware never wraps. They're easy to introduce in large, old codebases like EPM, which date from a time when the management server was assumed to sit on a trusted LAN.

The gap between Ivanti's "no known exploitation" at release and CISA's KEV listing four weeks later is also typical. Attackers often reverse-engineer a vendor patch to find the bug. If you run off-the-shelf infrastructure software, the time between patch release and exploitation is your real deadline, not the KEV date.

The bigger lesson is about what a management plane holds. Endpoint managers, CI servers, RMM tools and configuration systems store high-privilege credentials so they can act on other machines. A read-only bug in one of these is effectively a credential dump. Teams building internal platforms should put authentication in front of every route by default (deny unless explicitly public), keep stored secrets in a vault with short-lived access, and make sure no single read path returns raw credentials.

What to do now

1. Upgrade the EPM core server and remote consoles to EPM 2024 SU5 or later. This also fixes CVE-2026-1602.
2. Take the core server off the internet. Allow access only from admin networks or jump hosts. If external access is unavoidable, put it behind a reverse proxy or WAF with source IP allowlisting.
3. Assume credentials may have been exposed if the server was reachable before you patched. Rotate the service accounts and privileged credentials EPM stores, and reduce their scope.
4. Review logs for unauthenticated requests to management endpoints and unusual credential access around and after February 2026.
5. Track KEV programmatically. Pull CISA's KEV JSON feed into your vulnerability management tool so exploited bugs in software you run get flagged automatically.

Related on TechLogHub

• Authentication explained
• Authorization explained
• SQL explained

Sources

• Ivanti: Security Advisory EPM February 2026 for EPM 2024
• Centre for Cybersecurity Belgium: Ivanti Endpoint Manager vulnerabilities advisory
• SecurityWeek: Recent Ivanti Endpoint Manager flaw exploited in attacks
• Field Effect: Ivanti Endpoint Manager active exploitation
• Qualys ThreatPROTECT: CISA warns about Ivanti EPM vulnerability