CVE-2026-1603

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288CWE-306

Affected software

VendorProductVersions
IvantiEndpoint Manager—

References

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 9, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-160308.1The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its pCVE-2026-160326.1The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint befCVE-2026-160338.5A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processingCVE-2026-160354.3The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OCVE-2026-160367.5The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challengeCVE-2026-160377.5Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS ModuleCVE-2026-160389.1The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on severCVE-2026-160396.5The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authentCVE-2026-160417.5The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creatiCVE-2026-160424.3The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated CVE-2026-160445.4Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board arcCVE-2026-160454.3Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token mana
CVE-2026-1603: High severity, CVSS 7.5 | Vulnix