Changeflow GovPing Vulnerability Management Ivanti EPM Authentication Bypass Vulnerability
Urgent Notice Added Final

Ivanti EPM Authentication Bypass Vulnerability

Favicon for www.cisa.gov CISA Known Exploited Vulnerabilities (KEV)
Published March 10th, 2026
Detected March 13th, 2026
Email

Summary

CISA has added a vulnerability (CVE-2026-1603) in Ivanti Endpoint Manager (EPM) to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, an authentication bypass allowing credential data leakage, affects versions before 2024 SU5.

View original document View source feed page

What changed

CISA has identified and cataloged a critical authentication bypass vulnerability (CVE-2026-1603) in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5. This vulnerability, rated with a CVSS score of 8.6 (HIGH), allows unauthenticated remote attackers to bypass authentication and potentially leak stored credential data. The vulnerability has been actively exploited and added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Organizations utilizing Ivanti EPM must immediately update their systems to version 2024 SU5 or later to remediate this vulnerability. Failure to patch may expose sensitive credential data, leading to further security compromises. This advisory highlights the critical need for prompt patching of known exploited vulnerabilities to maintain system security and prevent data breaches.

What to do next

  1. Update Ivanti Endpoint Manager to version 2024 SU5 or later.
  2. Review systems for any signs of compromise related to CVE-2026-1603.
  3. Consult Ivanti's security advisory for detailed remediation steps.

Source document (simplified)

Required CVE Record Information

CNA: Ivanti

Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

CWE 1 Total

Learn more
- CWE-288: CWE-288: Authentication Bypass Using an Alternate Path or Channel

CVSS 1 Total

Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 8.6 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |

Product Status

Learn more Versions 1 Total

Default Status: affected

unaffected

  • unaffected at 2024 SU5

References 1 Total

Authorized Data Publishers

Learn more

CISA-ADP

Updated:

2026-03-10

SSVC and KEV, plus CVSS and CWE if not provided by the CNA.

SSVC 1 Total

Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | yes | total | 2.0.3 | 2026-02-17 |

KEV 1 Total

Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1603 (2026-03-09)

Related changes

Favicon for sam.gov SAM.gov Entity Exclusions Unavailable Due to Maintenance
Routine Mar 14, 2026 • SAM.gov Entity Exclusions (Debarments & Suspensions) • Trade Procurement
Favicon for sam.gov SAM.gov Entity Registration and Exclusions Unavailable
Routine Mar 14, 2026 • SAM.gov Entity Exclusions (Debarments & Suspensions) • Trade Procurement
Favicon for sam.gov SAM.gov Entity Exclusions Unavailable During Maintenance
Routine Mar 14, 2026 • SAM.gov Entity Exclusions (Debarments & Suspensions) • Trade Procurement
Favicon for wid.cert-bund.de CPython Vulnerabilities Allow Remote Code Execution
Priority review Mar 13, 2026 • CERT-Bund Security Advisories • Vulnerability Alerts
Favicon for wid.cert-bund.de Vim Vulnerability Allows Code Execution (CVSS 6.6)
Priority review Mar 13, 2026 • CERT-Bund Security Advisories • Vulnerability Alerts
Favicon for wid.cert-bund.de FreeRDP Vulnerabilities - Remote Code Execution
Priority review Mar 13, 2026 • CERT-Bund Security Advisories • Vulnerability Alerts

Source

Favicon for www.cisa.gov
CISA Known Exploited Vulnerabilities (KEV) cisa.gov/known-exploited-vulnerabilities-catalog
Vulnerability Management
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
Various Federal Agencies
Published
March 10th, 2026
Compliance deadline
March 9th, 2026 (5 days ago)
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive

Who this affects

Applies to
Technology companies Manufacturers
Geographic scope
National (US)

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Topics
Vulnerability Management Data Security

Browse Categories

Federal Courts 26 State Courts 91 Securities Regulation 6 Financial Regulation 43 Consumer Protection 5 Drug Safety 45 Data Protection 21 Competition 2 Attorneys General 3 Insurance Regulation 5 Trade & Export 36 Legislation 42 Energy Regulation 13 Environment 3 Labor & Employment 2 Tax 1

Get Vulnerability Management alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CISA Known Exploited Vulnerabilities (KEV) publishes new changes.

Free. Unsubscribe anytime.