Ivanti Endpoint Manager Authentication Bypass (CVE-2026-1603)

Historical catalog analysis: CISA added this entry on March 09, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-1603 is an authentication bypass vulnerability affecting Ivanti Endpoint Manager (EPM). The flaw involves the use of an alternate path or channel (CWE-288), which could allow a remote, unauthenticated attacker to leak specific stored credential data. On March 9, 2026, CISA added this vulnerability to its Known Exploited Vulnerabilities catalog.

Exposure and applicability

This vulnerability is applicable to healthcare organizations and business associates utilizing Ivanti EPM for enterprise endpoint management. In a clinical environment, the leakage of stored credentials from a management server could provide an attacker with the necessary privileges to move laterally across the network. This creates a risk of unauthorized access to systems containing electronic Protected Health Information (ePHI) or the potential deployment of ransomware across patient-care networks.

Remediation priorities

Based on our analysis, healthcare IT and security leaders should prioritize the following actions to reduce exposure:

1. Apply Vendor Mitigations: The primary priority is to implement the mitigations provided by Ivanti. This addresses the root cause of the authentication bypass to prevent initial credential leakage.
2. Review Cloud Service Configurations: For organizations utilizing EPM via cloud services, we recommend following applicable BOD 22-01 guidance to ensure the environment is secured according to federal standards for cloud security.
3. Evaluate Product Viability: In scenarios where mitigations are unavailable or cannot be applied due to clinical system constraints, organizations should evaluate whether to discontinue use of the product to eliminate the risk.

How to validate remediation

To verify that exposure has been reduced, we suggest the following validation methods:

• Configuration Audit: IT administrators should verify that the specific vendor-prescribed patches or configuration changes have been successfully applied across all EPM instances.
• Credential Rotation: As a damage-limitation measure, security teams should consider rotating credentials that may have been stored within the affected EPM environment, as patching alone does not invalidate previously leaked data.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA has set a remediation deadline of March 23, 2026, for federal agencies, this date is not a legal requirement for private healthcare providers, though it serves as a critical benchmark for risk management. Organizations should note that applying mitigations could reduce the likelihood of exploitation but does not guarantee total prevention against all attack vectors.

Source and editorial note

CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability · Source date: March 09, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 12, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 16, 2026 at 00:57 UTC.

Request a healthcare security assessment