CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability

Ivanti Endpoint Manager contains an authentication bypass vulnerability that allows a remote unauthenticated attacker to obtain specific stored credential data. The issue arises from an alternate access path that circumvents normal authentication controls, which is particularly concerning in endpoint management platforms that commonly store credentials used for device administration and software distribution.

How it works

The weakness is tracked as CWE-288, authentication bypass using an alternate path or channel. In this class of flaw an application exposes a secondary route to protected resources that does not enforce the same authentication checks applied to the primary interface. An attacker who discovers or reaches that route can retrieve credential material without presenting valid credentials.

Because the bypass occurs at the application layer rather than through a traditional login flow, standard authentication logs may not record the activity. Exploitation therefore relies on the existence of the unprotected channel rather than on stolen passwords or session tokens.

Am I affected? How to find it in your systems

Ivanti Endpoint Manager is typically installed on servers that manage Windows and other endpoints across an enterprise. Begin by locating all instances through asset inventories, configuration management databases, or network scans for known EPM service ports and web interfaces. Confirm the exact versions and deployment configurations against the vendor advisory, as not every installation is necessarily exposed.

• Examine web server and application logs for requests to credential-related endpoints that lack preceding authentication events.
• Review any custom integrations or exposed management APIs that could constitute an alternate channel.
• Check whether the EPM server is reachable from untrusted networks or hosts that should not have administrative access.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, reduce the attack surface of management consoles by restricting network access to only the management workstations or subnets that require it and by disabling any optional interfaces or APIs that are not in active use.

If you can't patch immediately

Until the update can be deployed, place the EPM server behind network segmentation controls so that only authorized management hosts can reach it. Web application firewall rules can be tuned to drop requests that target known credential paths without valid session tokens. Where feasible, disable the affected feature or channel entirely. CISA directs organizations to follow the mitigations listed in the vendor instructions, to apply applicable BOD 22-01 guidance for any cloud-hosted components, or to discontinue use of the product if mitigations cannot be implemented.

If your data may have been exposed

Authentication bypass vulnerabilities that result in credential leakage can enable further access within an environment. Review authentication and access logs for signs of unexpected data retrieval and consider running a free exposure scan of organizational email addresses against known breach datasets to determine whether any credentials have already appeared in public repositories.