Ivanti Endpoint Manager: Authentication bypass leaks stored credentials

Summary

Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass that allows a remote, unauthenticated attacker to leak specific stored credential data. No login or user interaction is required, so EPM servers reachable from the internet or exposed on the LAN are at risk. CISA added the flaw to its KEV catalog as known exploited on 9 March 2026, and the vendor provides a patch.

Affected

• Ivanti Endpoint Manager (EPM) versions before 2024 SU5
• Per vendor information: 2024 SU4 SR1 and earlier 2024 releases
• Older branches: Unknown.

Fixed in

• Ivanti Endpoint Manager 2024 SU5 (fixes CVE-2026-1603 according to Ivanti)
• Fixes are available in the Ivanti License System portal (login required)
• Fixes for older branches: Unknown.

Workaround

• Vendor workaround: Unknown. Ivanti's primary mitigation is updating to 2024 SU5.
• Own measure until patched: restrict access to EPM management interfaces to internal admin networks or VPN.
• CISA: apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable.

Exploitation

• CISA KEV: added 9 March 2026 as known exploited; due date 23 March 2026. Use in ransomware campaigns: Unknown.
• Ivanti stated at disclosure (10 February 2026) that it had no evidence of exploitation in the wild.
• One report claims exploitation since mid-February 2026; unverified.
• Public technical research exists (watchTowr, Horizon3.ai validation test); a public exploit script is not confirmed.
• Ivanti has not published specific IOCs.

Our recommendation

• Identify all EPM instances, including those still named LANDesk or LDMS.
• Patch to 2024 SU5 using the Ivanti advisory; for older versions, check the advisory for an upgrade path.
• Remove internet exposure of EPM services immediately if patching is delayed.
• Review logs for unexpected or unauthenticated access and rotate credentials stored in or managed by EPM.
• Verify patch status with a validation test if available. Treat unpatched systems as a priority incident response matter, since the CISA due date has passed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Ivanti Security Advisory EPM February 2026 for EPM 2024 hub.ivanti.com
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• Horizon3.ai CVE-2026-1603 research horizon3.ai
• Action1 CVE-2026-1603 www.action1.com
• Beazley known abuse of Ivanti EPM authentication bypass beazley.security
• Field Effect: Ivanti Endpoint Manager active exploitation fieldeffect.com
• Canadian Centre for Cyber Security AV26-113 www.cyber.gc.ca
• Ivanti February 2026 security update www.ivanti.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:02.