Loading story…
Attackers increased exploitation attempts against an authentication bypass flaw in Ivanti Endpoint Manager tracked as CVE-2026-1603, a vulnerability that can let unauthenticated actors gain access and potentially steal user credentials. Ivanti published a security advisory for the affected EPM 2024 product line in February, and the vulnerability was publicly disclosed through the CVE record shortly afterward.
Mitsui Bussan Secure Directions reported that its SOC began observing exploitation attempts on March 13 and saw activity rise further after mid-April. The flaw was also added to CISA's Known Exploited Vulnerabilities catalog on March 9, indicating confirmed in-the-wild abuse, and defenders using affected Ivanti Endpoint Manager deployments were urged to apply the vendor's fixed version without delay.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC observed that exploitation activity targeting CVE-2026-1603 increased after mid-April 2026, showing growing attacker interest in the Ivanti Endpoint Manager flaw.
MBSD-SOC reported detecting attacks targeting CVE-2026-1603 beginning on March 13, 2026. Observed requests included POST traffic to /RemoteControlAuth/api/Auth using logintype set to 64 in an apparent authentication bypass attempt.
CISA added CVE-2026-1603 to its Known Exploited Vulnerabilities catalog, indicating confirmed exploitation in the wild.
CVE-2026-1603 was publicly disclosed as an authentication bypass vulnerability in Ivanti Endpoint Manager. Successful exploitation can bypass authentication and may enable theft of user credentials.
Ivanti issued a security advisory for Endpoint Manager 2024 covering CVE-2026-1603, which affects versions earlier than 2024 SU5 and requires upgrading to a fixed release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA added Ivanti Endpoint Manager (EPM) vulnerability `CVE-2026-1603` to the Known Exploited Vulnerabilities (KEV) catalog**, warning it is being actively exploited and directing U.S. federal agencies to remediate within mandated timelines. The flaw is described as an **authentication bypass** (CWE-288) that allows **remote, unauthenticated** attackers to access and **steal sensitive stored credential data**, creating elevated risk because EPM is commonly used as a central platform for managing large endpoint fleets. Ivanti addressed `CVE-2026-1603` in **Ivanti EPM 2024 SU5**; reporting indicates the same release also fixed an **SQL injection** issue that could allow authenticated attackers to read arbitrary database data. Public reporting notes CISA did not provide detailed exploitation telemetry, and Ivanti stated it was not aware of customer exploitation prior to public disclosure; external monitoring cited **700+ internet-facing EPM instances** observed by Shadowserver, underscoring potential exposure where systems remain unpatched.
Jun 29, 2026
Ivanti disclosed active exploitation of **CVE-2026-6973**, a high-severity improper input validation flaw in on-premises **Endpoint Manager Mobile (EPMM)** that allows remote code execution when used with administrator authentication. The company said exploitation has been limited to a small number of customers and assessed with high confidence that attackers are using administrator credentials stolen during earlier January attacks involving **CVE-2026-1281** and **CVE-2026-1340**. Affected versions are EPMM releases prior to **12.6.1.1**, **12.7.0.1**, and **12.8.0.1**; Ivanti said **Neurons for MDM**, **EPM**, **Sentry**, and other products are not affected. Ivanti also patched four additional high-severity EPMM flaws—**CVE-2026-5786**, **CVE-2026-5787**, **CVE-2026-5788**, and **CVE-2026-7821**—covering certificate validation and access-control weaknesses that could enable host impersonation, unauthorized access, arbitrary method invocation, and unauthorized device enrollment, though the vendor said it has no evidence those bugs were exploited. **CISA** added CVE-2026-6973 to its **Known Exploited Vulnerabilities** catalog and ordered U.S. federal agencies to remediate by **May 10, 2026**, while national cyber agencies in Canada and Finland urged immediate patching. Ivanti advised customers to rotate EPMM administrator credentials, review privileged accounts, hunt for compromise artifacts such as webshells and reverse shells, and reduce public exposure of management interfaces; internet scans have identified more than **850** exposed EPMM instances, mainly in Europe and North America.
Jun 29, 2026
Ivanti released security updates for *Endpoint Manager (EPM)* to fix two vulnerabilities affecting **EPM 2024 SU4 SR1 and earlier**: **CVE-2026-1603** (CVSS 8.6) and **CVE-2026-1602** (CVSS 6.5). CVE-2026-1603 is an **authentication bypass** that can be exploited by a **remote, unauthenticated** attacker to access/leak specific **stored credential data**, creating a high-risk path to credential exposure and follow-on compromise in environments where EPM operates with elevated privileges across endpoints. CVE-2026-1602 is a **SQL injection** issue that requires **authentication** and can allow a remote authenticated attacker to **read arbitrary data from the EPM database**, driving confidentiality risk (data leakage) rather than integrity/availability impact. The fixed release is **EPM 2024 SU5**, and the update also addresses **11 medium-severity vulnerabilities** previously disclosed in October 2025; organizations running affected versions were advised to patch immediately due to the platform’s central role in enterprise endpoint administration.
Jun 29, 2026