IvantiExploited incident
Ivanti Endpoint Manager (EPM) authentication bypass leaking stored credentials
CVE-2026-1603High, CVSS 8.6In CISA's Known Exploited Vulnerabilities catalog since 9 Mar 2026
- Exploited after a fix existed
Response
- Silence
- 0h First public report to first vendor statement
- Exposure
- same day First public report to first fix
- Follow-through
- same day First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
Ivanti blog RSS feed, item 'February 2026 Security Update'CuratedQuote verified
Tue, 10 Feb 2026 15:05:16 Z
Patch Tuesday disclosure through Ivanti's responsible disclosure program; the post says 'We have no evidence of this vulnerability being exploited in the wild.' The feed is a rolling list; this item will eventually drop off it.
- Source
- Ivanti blog RSS feed, item 'February 2026 Security Update' vendor blog
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:cb2b41e6a67111c7…- Used in metrics
- Yes
3 more sources for this moment
CVE.org record CVE-2026-1603ClaimedQuote verified10 Feb 2026, 15:09 UTC
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
CVE record published.
- Source
- CVE.org record CVE-2026-1603 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:8f72cda501598154…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet10 Feb 2026, 16:17 UTC
🟠 CVE-2026-1603 - High (8.6)
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2026-1603)ClaimedQuote verified9 Mar 2026
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
Added to CISA's KEV catalog on 2026-03-09.
- Source
- CISA KEV (CVE-2026-1603) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Vendor statement
at disclosure
Ivanti blog RSS feed, item 'February 2026 Security Update'CuratedQuote verified
Tue, 10 Feb 2026 15:05:16 Z
- Source
- Ivanti blog RSS feed, item 'February 2026 Security Update' vendor blog
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:cb2b41e6a67111c7…- Used in metrics
- Yes
2 more sources for this moment
Ivanti blog: February 2026 Security UpdateCuratedQuote verified10 Feb 2026
today Ivanti is disclosing vulnerabilities in Ivanti Endpoint Manager (EPM).
Page shows 'Last updated: February 10, 2026'.
- Source
- Ivanti blog: February 2026 Security Update vendor blog
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:0cdf782e59b95d12…- Used in metrics
- No, kept for the record
CVE record CVE-2026-1603 (CNA: Ivanti)CuratedQuote verified10 Feb 2026, 15:09 UTC
"datePublished":"2026-02-10T15:09:35.459Z"
- Source
- CVE record CVE-2026-1603 (CNA: Ivanti) cve record
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:8f72cda501598154…- Used in metrics
- No, kept for the record
First workaround
No official mitigation found yet.
First fix
date onlysame day
BleepingComputerCuratedQuote verified
Ivanti patched the vulnerability one month ago, when it released Ivanti EPM 2024 SU5
Article dated March 10, 2026. The fix (EPM 2024 SU5) accompanied the 2026-02-10 advisory per Ivanti's blog and the CVE record ('before version 2024 SU5'). One secondary source gives 2026-02-12 for the patch; not confirmed.
- Source
- BleepingComputer news
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:fe17ba1b5df8636d…- Used in metrics
- Yes
Fixed for all versions
date onlysame day
CVE record CVE-2026-1603 (CNA: Ivanti)CuratedQuote verified
before version 2024 SU5
Single supported line (EPM 2024); fixed by 2024 SU5. EPM 2022 is end of life and not listed.
- Source
- CVE record CVE-2026-1603 (CNA: Ivanti) cve record
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:8f72cda501598154…- Used in metrics
- Yes
Send this to your boss
No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.
Affected products
- Ivanti Endpoint Manager (EPM) 2024
How we built this timeline
Coordinated disclosure on Patch Tuesday 10 Feb 2026 with the fix; KEV 9 Mar 2026 (Ivanti told BleepingComputer it had no reports of exploitation).
One secondary source says watchTowr disclosed a related hard-coded key three days after publication; not verified. 2024 SU5 also fixed an authenticated SQL injection (CVE not confirmed, not listed). Severity: Ivanti CVSS 3.1 8.6;
NVD 7.5. The Ivanti advisory page is JavaScript-only.