Ivanti Endpoint Manager Vulnerability Lets Remote Attacker Leak Arbitrary Data

Ivanti released security updates for Endpoint Manager (EPM 2024 SU5) addressing two vulnerabilities: CVE-2026-1603 (auth bypass, CVSS 8.6) that can leak stored credentials without authentication, and CVE-2026-1602 (SQL injection, CVSS 6.5) allowing authenticated attackers to read arbitrary database data; the flaws affect EPM 2024 SU4 SR1 and earlier, have been patched, and no active exploitation was observed before disclosure.