CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Allows Credential Leakage
What It Is – Ivanti Endpoint Manager (EPM) contains an authentication‑bypass flaw that can be triggered via an alternate path or channel. An unauthenticated remote attacker can exploit the bug to retrieve stored credential data.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept code has been observed in the wild. CVSS v3.1 is currently rated 7.8 (High).
Affected Products – Ivanti Endpoint Manager (all supported versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication mechanisms enforce the principle of least privilege.
- Highlights gaps in evidence collection for privileged‑access monitoring—critical when auditors demand a defensible audit trail.
- Reinforces the importance of rapid patch management as a control‑evidence activity that underpins a trustworthy security posture.
Recommended Actions
- Deploy Ivanti’s security patch for CVE‑2026‑1603 immediately.
- Review and harden authentication pathways; enforce multi‑factor authentication for all privileged accounts.
- Enable comprehensive logging of authentication attempts and integrate logs into a SIEM for continuous monitoring.
- Conduct a post‑patch validation to confirm the bypass is fully mitigated and capture evidence for audit readiness.
Source: CISA KEV – CVE‑2026‑1603