CISA Alerts on Ivanti Endpoint Manager Vulnerability Auth Bypass Exploited in the Wild

CISA has added CVE-2026-1603 — an authentication-bypass vulnerability in Ivanti Endpoint Manager (CWE-288) — to its Known Exploited Vulnerabilities catalog after observing active exploitation; the flaw could allow unauthenticated attackers to bypass authentication and retrieve stored credential data. CISA requires federal agencies to remediate under BOD 22-01 and advises all affected organizations to apply vendor mitigations, restrict external access, monitor for signs of compromise, and prioritize this KEV-listed vulnerability for patching.