# CVE-2026-1603: Endpoint Manager - Authentication Bypass

> Live exploitation tracking for CVE-2026-1603 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-1603

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.6
- **Public exploit available:** Yes
- **Affected products:** Ivanti Endpoint Manager
- **Weaknesses:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel); CWE-306 (Missing Authentication for Critical Function)
- **Tags:** enterprise_software

## Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

## CrowdSec analysis

[CVE-2026-1603](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-1603) is an authentication bypass vulnerability in Ivanti Endpoint Manager prior to version 2024 SU5, which allows remote unauthenticated attackers to leak specific stored credential data. This flaw could be exploited to expose sensitive information, potentially leading to further compromise of affected systems or unauthorized access to network resources.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-1603 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-1603 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-1603 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the authentication bypass by sending crafted POST requests to the `/RemoteControlAuth/api/Auth` endpoint, allowing unauthorized access and potential leakage of credential data.

## Timeline

- 2026-02-10: CVE Published. CVE-2026-1603 is published to NVD.
- 2026-03-09: CISA KEV. CVE-2026-1603 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-03-23: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2026-1603 exploitation attempts against the CrowdSec Network.
- 2026-04-01: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-1603 for the first time.

## References

- https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1603
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1603.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-1603) follows observed exploitation activity for CVE-2026-1603. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.