Is CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass) being exploited in the wild?

How CVE-2026-1603 Becomes an In-the-Wild Exploitation Question

The practical question is not just whether Ivanti EPM has a flaw, but whether that flaw has crossed from “theoretical exposure” into active adversary use. When CISA places a CVE in the KEV catalogue, the operational assumption changes immediately: exposure should be treated as real until proven otherwise, and triage should focus on inventory, containment, and evidence of access rather than on debating exploitability.

For this kind of vulnerability, the first task is confirming where Ivanti Endpoint Manager is present, whether the affected service path is reachable, and whether any internet-facing or partner-facing deployments exist. If the product is in scope, the next question is whether the environment contains secrets, sessions, or administrative pathways that an unauthenticated bypass could expose, because the business impact depends on what the bypass can reach, not just on the bypass itself.

What the Authentication Bypass Means Operationally

An authentication bypass through an alternate path or channel is especially dangerous because it can defeat the normal control plane without needing valid user credentials. In practice, that means a remote attacker may be able to reach stored credential material or adjacent management functions even when normal login protection looks intact. That is why this class of issue is often paired with credential rotation, session invalidation, and a check for abnormal administrative actions after remediation.

For a vulnerability like this, exposure should be framed in terms of blast radius. If the compromised path can reveal stored credentials or management data, attackers may use that access to move from initial foothold to broader administrative control, lateral movement, or follow-on compromise. The right response is to ask what privileged data or trust relationships the affected EPM instance can touch, then treat any secrets reachable through that path as potentially exposed.

Authoritative status should come from the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog, not from assumptions about patching pace or exploit style. For background on how active exploitation changes prioritisation, see the Zero-Day and Exploited Vulnerabilities Guide, which covers KEV triage, emergency mitigation, and post-patch hunting.

What to Check Before and After Remediation

The most useful validation is whether the EPM deployment was reachable in the way an attacker would need. That includes confirming exposed management interfaces, reviewing whether compensating controls actually constrained the bypass path, and checking logs for unusual authentication failures followed by successful administrative access or unexpected credential retrieval activity. If the product stores secrets, certificates, or service credentials, assume those items may need review even when the exploit did not visibly disrupt the system.

After remediation, teams should verify more than “the version is fixed.” They should confirm that the vulnerable path is no longer reachable, that cached sessions have been invalidated where relevant, and that any data the bypass could have exposed has been rotated or reissued if it was sensitive enough to enable further access. Where the environment includes automation or service integrations, credential rotation is often the more important control outcome than simply removing the vulnerable binary.

For identity-bearing material and privileged access paths, the Vulnerability Management Guide is useful because it ties prioritisation to verification and exception handling, while the PAM Buyer’s Guide is a good reference when the exposed system sits on a privileged management path that should be reduced or segmented.

Risk and Threat Considerations

Once a vulnerability is in CISA’s KEV catalogue, the main risk is not just exploitation, but delayed containment in environments that treat management tooling as trusted by default. An authentication bypass on endpoint management infrastructure can expose credentials, administrative data, and downstream trust relationships that attackers can reuse for persistence or lateral movement.

Failure mechanism: An alternate path or channel bypasses normal authentication, allowing an unauthenticated remote actor to reach stored credential data or privileged management functions and then reuse that access for broader compromise.

Impact: Exposure can extend beyond the EPM instance itself to service accounts, delegated admin access, and any connected systems that trust the management plane. If attackers harvested usable secrets before detection, containment may require credential rotation and a compromise assessment, not only patching.

Practitioner Guidance

What to prioritise: Treat the KEV listing as a triage trigger. Start with whether Ivanti EPM is deployed, whether the vulnerable path is reachable, and whether the instance can access secrets, admin roles, or integrated systems that raise the impact of a bypass.

What to verify: Confirm whether authentication logs, admin actions, and secret access events show anomalous behaviour around the exposure window. If the bypass could have revealed credentials, validate rotation status for those credentials before assuming the system is clean.

Decision rule: If the system handled privileged data or stored credentials, treat the event as potential compromise until logs and rotation evidence say otherwise. If the vulnerable function was isolated and no sensitive material was reachable, the response can be narrower, but the KEV status still warrants rapid remediation.

Practitioner takeaway: For exploited-management-plane flaws, the right question is not “did we patch?” but “what privileged trust may already have been exposed, and what must be rotated or revalidated because of it?”

Related resources from NHI Mgmt Group

• CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass)
• CVE-2025-4427 (Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass)
• CVE-2023-35082 (Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass)
• CVE-2023-35078 (Ivanti Endpoint Manager Mobile Authentication Bypass)