Endpoint Manager - Authentication Bypass (CVE-2026-1603)
Description
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
psychologyCrowdSec Analysis
CVE-2026-1603 is an authentication bypass vulnerability in Ivanti Endpoint Manager prior to version 2024 SU5, which allows remote unauthenticated attackers to leak specific stored credential data. This flaw could be exploited to expose sensitive information, potentially leading to further compromise of affected systems or unauthorized access to network resources.
CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.
CrowdSec network data shows that most actors exploiting CVE-2026-1603 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-1603 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-1603 is currently experiencing high visibility and active exploitation across the internet.
Attackers exploit the authentication bypass by sending crafted POST requests to the /RemoteControlAuth/api/Auth endpoint, allowing unauthorized access and potential leakage of credential data.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-02-10 |
| CISA KEV | 2026-03-09 |
| CISA Remediation Deadline | 2026-03-23 |
| Rule Released | 2026-03-30 |
| CrowdSec First Seen | 2026-04-01 |
Related Weaknesses
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.