CVE-2026-1603

Ivanti Endpoint Manager allows remote unauthenticated attackers to bypass authentication and leak stored credentials via an alternate path.

This authentication bypass vulnerability enables remote attackers to access sensitive credential data without authentication, posing a severe risk to DIB organizations relying on Ivanti EPM for endpoint management. The exploitability of an unauthenticated path to leak credentials directly impacts compliance with FedRAMP and NIST 800-171 requirements for access control and data confidentiality. DIB orgs must immediately patch affected systems and audit all credential stores for potential exposure.

Shame score — An unauthenticated authentication bypass allowing credential leakage is a critical security failure that undermines trust in endpoint management solutions.