{"id":"ivanti-epm-credential-leak-feb-2026","category":"patch","status":"closed","title":"Ivanti Endpoint Manager credential-leaking login bypass CVE-2026-1603 used in attacks; fixed in SU5","tldr":"Attackers are exploiting a flaw in Ivanti Endpoint Manager that exposes certain stored credentials without a login. It affects business management systems before EPM 2024 SU5. Ask your IT team to confirm the server has been updated.","summary":"CVE-2026-1603 affects Ivanti Endpoint Manager, software organisations use to manage their computers and other devices. An attacker who can reach a vulnerable system can bypass a login check and obtain certain stored credentials; the documented impact is credential exposure. Ivanti’s CVE record identifies versions before EPM 2024 SU5 as affected and SU5 as fixed. Ivanti initially said it had no evidence of exploitation, but CISA listed the flaw as exploited on 9 March. Ivanti subsequently told BleepingComputer it had received no exploitation reports. The reviewed reports do not identify victims or establish the scale of attacks. As of 3 November, no later development was found changing the fix or establishing that attacks had ended.","action":"If your business or family office uses Ivanti Endpoint Manager, ask its IT provider to confirm the EPM server has been updated to 2024 SU5 or a newer supported release. This requires an administrator’s update to the management system.","product":"Ivanti Endpoint Manager (EPM)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-1603"],"tags":["ivanti","epm","authentication-bypass","credential-theft","exploited"],"affected":["Ivanti Endpoint Manager versions before 2024 SU5"],"fixed":["Ivanti Endpoint Manager 2024 SU5"],"matches":[],"sources":[{"kind":"advisory","title":"February 2026 Security Update","url":"https://www.ivanti.com/blog/february-2026-security-update","by":"Ivanti","date":"2026-02-10"},{"kind":"advisory","title":"Ivanti-authored CVE-2026-1603 record, reproduced by CIRCL","url":"https://cve.circl.lu/vuln/cve-2026-1603","by":"Ivanti, via CIRCL Vulnerability-Lookup","date":"2026-02-10"},{"kind":"advisory","title":"Ivanti security advisory (AV26-113) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-113","by":"Canadian Centre for Cyber Security","date":"2026-03-09"},{"kind":"news","title":"CISA: Recently patched Ivanti EPM flaw now actively exploited","url":"https://www.bleepingcomputer.com/news/security/cisa-recently-patched-ivanti-epm-flaw-now-actively-exploited/","by":"BleepingComputer","date":"2026-03-10"},{"kind":"advisory","title":"Exploitation of Ivanti Endpoint Manager Vulnerability","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4752","by":"NHS England","date":"2026-03-11"}],"started":"2026-03-09","closed":"2026-03-11","created":"2026-11-03T22:25:59.609Z","updated":"2026-11-03T22:25:59.609Z","cve_notes":[{"cve":"CVE-2026-1603","name":"Login bypass exposes stored credentials in Ivanti EPM","what":"An authentication bypass in Ivanti Endpoint Manager before 2024 SU5 lets a remote attacker obtain certain stored credentials without signing in.","severity":"high","cvss":8.6}],"timeline":[{"at":"2026-03-11","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"NHS England warned organisations about the confirmed exploitation, assessed further attacks as highly likely and urged them to apply Ivanti’s update.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4752","by":"NHS England","patch":null},{"at":"2026-03-10","added":"2026-11-03T22:23:55.101Z","kind":"other","text":"BleepingComputer reported that Ivanti had received no exploitation reports when contacted on 9 March, despite CISA’s finding. Public details of the attacks were unavailable.","url":"https://www.bleepingcomputer.com/news/security/cisa-recently-patched-ivanti-epm-flaw-now-actively-exploited/","by":"BleepingComputer","patch":null},{"at":"2026-03-09","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2026-1603 to its Known Exploited Vulnerabilities catalogue. Canada’s Cyber Centre updated its alert and urged administrators to apply the updates.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-113","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-02-10","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Ivanti’s published CVE record identified EPM versions before 2024 SU5 as vulnerable and marked 2024 SU5 as unaffected. The flaw lets someone without a login obtain certain stored credentials remotely.","url":"https://cve.circl.lu/vuln/cve-2026-1603","by":"Ivanti, via CIRCL Vulnerability-Lookup","patch":"patched"},{"at":"2026-02-09","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"According to Canada’s Cyber Centre, Ivanti published its EPM advisory on 9 February, covering EPM 2024 SU4 SR1 and earlier.","url":"https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-113","by":"Canadian Centre for Cyber Security","patch":null}],"url":"https://hard.fyi/live/ivanti-epm-credential-leak-feb-2026/","json":"https://hard.fyi/api/live?id=ivanti-epm-credential-leak-feb-2026"}