Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2026-1603

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.

CVSS 8.6 · HighBuzz score 68.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 68.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 23.0 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
23.0
9 evidence mentions in the snapshot
Diversity score
20.0
6 sources across 4 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
9 source links · newest first
  • CVE-2026-10520 Exploited: Ivanti Sentry Gateways Compromised Shortly After Patch ReleaseSecurity Affairs

    Attackers are exploiting the critical CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released. Threat actors have started exploiting a maximum-severity OS command injection flaw in Ivanti Sentry, tracked as CVE-2026-10520, that allows remote code execution with root privileges. “An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote […]

    newssecurityaffairs.comJun 11, 2026, 5:57 PM
  • CISA warns of actively exploited Ivanti EPM and Cisco SD-WAN flawsCSO Online

    The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that an authentication bypass vulnerability patched in Ivanti Endpoint Manager (EPM) last month is now being exploited in the wild. The agency has also updated its directive related to two Cisco Catalyst SD-WAN flaws that were also fixed last month after being used in zero-day […]

    newswww.csoonline.comMar 11, 2026, 10:46 PM
  • Recent Ivanti Endpoint Manager Flaw Exploited in AttacksSecurityWeek

    CISA has added the high-severity authentication bypass vulnerability to its KEV list, along with SolarWinds and Workspace One bugs.

    newswww.securityweek.comMar 10, 2026, 11:51 AM
  • U.S. CISA adds Ivanti EPM, SolarWinds, and Omnissa Workspace One flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds EPM, SolarWinds, and Omnissa Workspace One flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple, Rockwell, and Hikvision flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: The first vulnerability added to the catalog is […]

    newssecurityaffairs.comMar 10, 2026, 9:52 AM
  • CVE-2026-1603Horizon3.ai

    Ivanti Endpoint Manager (EPM) | Authentication Bypass Vulnerability

    exploithorizon3.aiFeb 18, 2026, 5:32 PM
  • Multiple Endpoint Manager bugs patched by Ivanti, including remote auth bypassSecurity Affairs

    Ivanti patched over a dozen Endpoint Manager flaws, including a high-severity auth bypass that let attackers steal credentials remotely. Ivanti released patches for more than a dozen vulnerabilities in Endpoint Manager, including flaws disclosed in October 2025. The update addresses a high-severity authentication bypass, tracked as CVE-2026-1603 (CVSS score of 8.6), that attackers could exploit […]

    newssecurityaffairs.comFeb 12, 2026, 6:13 AM
  • Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025SecurityWeek

    It also fixed a high-severity authentication bypass that could be exploited remotely without authentication to obtain credentials.

    newswww.securityweek.comFeb 11, 2026, 12:14 PM
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1603www.cisa.gov

    No excerpt available.

    Mitigationwww.cisa.govFeb 10, 2026, 4:16 PM
  • https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_UShub.ivanti.com

    No excerpt available.

    Vendor Advisoryhub.ivanti.comFeb 10, 2026, 4:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence