CVE-2026-1603: Ivanti EPM Auth Bypass -- Unauthenticated Credential Data Leak

Background

Ivanti Endpoint Manager (EPM) is an enterprise endpoint management platform used by IT teams to deploy software, manage device configurations, enforce security policies, and monitor endpoints. EPM holds significant sensitive data: device inventory, software deployment credentials, service account passwords, and stored credentials used to authenticate to endpoints during management operations.

Ivanti’s product portfolio has faced sustained scrutiny following a series of high-severity vulnerabilities across VPN and endpoint management products (CVE-2023-46805, CVE-2024-21887, CVE-2024-29824). CVE-2026-1603 adds another unauthenticated authentication bypass to the Ivanti catalogue. CISA added it to the KEV catalogue on 2026-03-09. The credential leak angle makes this particularly damaging — stolen EPM credentials can enable lateral movement and privilege escalation across the entire managed endpoint estate.

Technical Mechanism

CVE-2026-1603 is classified as “authentication bypass using alternate path or channel” (CWE-288). This vulnerability class occurs when an application has a primary authentication-enforced path, but also exposes an alternate path or endpoint that bypasses the authentication check.

In the context of Ivanti EPM, the alternate path likely involves:

1. An API endpoint or URL path that is not covered by the standard authentication middleware
2. A legacy endpoint retained for backward compatibility that was excluded from updated authentication requirements
3. A path where the request routing logic differs from the authentication enforcement logic, creating a gap

The attack flow is as follows:

1. An unauthenticated attacker sends a crafted HTTP request to the alternate endpoint, bypassing the normal login requirement
2. The endpoint, believing the request to be from an authorised user or system, returns stored credential data
3. The credential data may include service account passwords, LDAP bind credentials, database credentials, or endpoint management account hashes
4. With these credentials, the attacker can:
   • Authenticate to managed endpoints using the EPM service account credentials
   • Access other enterprise systems using extracted service account passwords
   • Escalate privileges if the EPM service account has domain admin or other elevated rights

The unauthenticated nature combined with the credential leak output makes this an extremely efficient initial access vector — a single HTTP request may yield domain credentials.

Real-World Exploitation Evidence

CVE-2026-1603 was added to CISA KEV on 2026-03-09. Ivanti EPM has been a recurring target:

• Prior Ivanti EPM exploitation — CVE-2024-29824 (SQL injection RCE in EPM) was heavily exploited in 2024, establishing threat actor familiarity with EPM attack surfaces
• Credential harvesting campaigns — threat actors have specifically targeted endpoint management tools for credential harvesting, recognising that EPM service accounts often have broad access to managed devices
• Nation-state and ransomware actors — both categories have demonstrated sustained interest in Ivanti products, with documented exploitation of multiple Ivanti CVEs across VPN and endpoint management product lines
• The pattern of Ivanti vulnerabilities points to structural issues in authentication architecture across product lines, making this a likely target for future research and exploitation

Impact Assessment

CVE-2026-1603 requires no credentials whatsoever: a single unauthenticated HTTP request to the alternate endpoint can return stored credential data from the EPM server. The attacker’s immediate gain is a set of service account credentials that EPM uses to authenticate to managed endpoints across the organisation — potentially including domain credentials, LDAP bind accounts, and database passwords. With these credentials, lateral movement to managed endpoints requires no additional exploitation; the attacker can simply authenticate using the recovered service account. The 9.8 CVSS score is justified by the combination of no authentication required, network-accessible exposure, and high-impact credential disclosure.

The organisational impact scales directly with EPM’s deployment footprint. Endpoint Manager installations in large enterprises manage thousands of devices, and the service account credentials used to reach those devices often carry administrative or elevated privileges. A successful credential theft gives an attacker the equivalent of a pass key to all managed endpoints simultaneously. This is particularly damaging for credential rotation response: because EPM holds credentials for many systems, a compromised EPM server requires organisation-wide credential rotation to fully remediate, which is operationally intensive and time-consuming. Healthcare, government, and critical infrastructure operators using EPM to manage OT-adjacent or sensitive systems face compounded risk, as EPM service account access may bridge network segments that are otherwise isolated.

Affected Versions

Consult the Ivanti Security Advisory for precise version ranges and patch availability.

Remediation Steps

1. Apply Ivanti’s patch immediately
2. Immediately after patching, rotate all credentials stored in Ivanti EPM:
   • Service account passwords used for endpoint management
   • LDAP/Active Directory bind credentials
   • Database credentials
   • Any cloud or third-party integration credentials
3. Restrict EPM server access to trusted internal networks — the management interface should not be internet-facing
4. Audit Active Directory for any signs of unauthorised access using service accounts associated with EPM
5. Review EPM access logs for any unauthenticated requests to sensitive API endpoints
6. Enable multi-factor authentication for EPM administrator accounts
7. Check endpoint managed devices for signs of lateral movement originating from EPM service accounts
8. If compromise is suspected, treat all credentials stored in EPM as compromised and perform organisation-wide credential rotation

Detection Guidance

Ivanti EPM logs — review application and access logs for:

• Requests to credential-related API endpoints without valid session tokens
• Bulk data retrieval patterns that exceed normal operational behaviour
• Access from IP addresses not associated with EPM administrator workstations

Active Directory monitoring:

• Authentication events using EPM service account credentials from unexpected source hosts or times
• LDAP queries using the EPM bind account from non-EPM systems
• Service account logon events outside normal management windows

SIEM query example (Splunk):

index=ivanti_epm sourcetype=epm_access
| search uri_path="*/credentials*" OR uri_path="*/serviceaccounts*"
| where isnull(session_token) OR session_token=""
| stats count by src_ip, uri_path, http_method
| sort -count

Network indicators:

• Lateral movement from endpoints using credentials that match EPM service account patterns
• Unusual authentication activity on domain controllers correlating with EPM server exposure

Timeline

References

• NVD — CVE-2026-1603
• CISA KEV — CVE-2026-1603
• Ivanti Security Advisory — CVE-2026-1603