Ivanti Endpoint Manager credential-leaking login bypass CVE-2026-1603 used in attacks; fixed in SU5
Attackers are exploiting a flaw in Ivanti Endpoint Manager that exposes certain stored credentials without a login. It affects business management systems before EPM 2024 SU5. Ask your IT team to confirm the server has been updated.
If your business or family office uses Ivanti Endpoint Manager, ask its IT provider to confirm the EPM server has been updated to 2024 SU5 or a newer supported release. This requires an administrator’s update to the management system.
What’s happening
CVE-2026-1603 affects Ivanti Endpoint Manager, software organisations use to manage their computers and other devices. An attacker who can reach a vulnerable system can bypass a login check and obtain certain stored credentials; the documented impact is credential exposure. Ivanti’s CVE record identifies versions before EPM 2024 SU5 as affected and SU5 as fixed. Ivanti initially said it had no evidence of exploitation, but CISA listed the flaw as exploited on 9 March. Ivanti subsequently told BleepingComputer it had received no exploitation reports. The reviewed reports do not identify victims or establish the scale of attacks. As of 3 November, no later development was found changing the fix or establishing that attacks had ended.
- What
- Flaw
- Affects
- Ivanti Endpoint Manager (EPM)
- Affected
- Ivanti Endpoint Manager versions before 2024 SU5
- Fixed in
- Ivanti Endpoint Manager 2024 SU5
- Since
- 9 Mar 2026
- Closed
- 11 Mar 2026
Timeline
- Update
NHS England warned organisations about the confirmed exploitation, assessed further attacks as highly likely and urged them to apply Ivanti’s update.
- Update
BleepingComputer reported that Ivanti had received no exploitation reports when contacted on 9 March, despite CISA’s finding. Public details of the attacks were unavailable.
- CISA added
CISA added CVE-2026-1603 to its Known Exploited Vulnerabilities catalogue. Canada’s Cyber Centre updated its alert and urged administrators to apply the updates.
- New fixFixed
Ivanti’s published CVE record identified EPM versions before 2024 SU5 as vulnerable and marked 2024 SU5 as unaffected. The flaw lets someone without a login obtain certain stored credentials remotely.
- Made public
According to Canada’s Cyber Centre, Ivanti published its EPM advisory on 9 February, covering EPM 2024 SU4 SR1 and earlier.
Sources
- February 2026 Security UpdateIvanti · 10 Feb 2026
- Ivanti-authored CVE-2026-1603 record, reproduced by CIRCLIvanti, via CIRCL Vulnerability-Lookup · 10 Feb 2026
- Ivanti security advisory (AV26-113) – Update 1Canadian Centre for Cyber Security · 9 Mar 2026
- CISA: Recently patched Ivanti EPM flaw now actively exploitedBleepingComputer · 10 Mar 2026
- Exploitation of Ivanti Endpoint Manager VulnerabilityNHS England · 11 Mar 2026