Actively exploited · Published Feb 10, 2026 · Assigned by ivanti
CVE-2026-1603
High 8.6 Exploited
In plain English
A high-severity authentication bypass in Endpoint Manager from Ivanti. Attackers are actively exploiting it in the wild (listed by CISA on March 9, 2026). The chance it is exploited in the next 30 days is estimated at 88.3% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 23, 2026.
Official description
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Endpoint Manager | see references |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N