# Ivanti Endpoint Manager authentication bypass and SQL injection

Published: 2026-02-10 · Severity: elevated · Sectors: government-national, defense
Canonical: https://vorant.io/reports/9fbacc0e-9f47-53ff-a440-3fd78639b032/ivanti-endpoint-manager-authentication-bypass-and-sql-injection

> Authentication bypass and SQL injection in Ivanti Endpoint Manager could leak stored credentials; no active exploitation reported.

Ivanti has disclosed multiple vulnerabilities in Endpoint Manager, a widely-deployed unified endpoint management platform. The most severe is an authentication bypass (CVE-2026-1603) that allows a remote unauthenticated attacker to leak specific stored credential data from affected systems. A second vulnerability, SQL injection (CVE-2026-1602), requires authentication but permits reading arbitrary data from the database. Both affect Ivanti Endpoint Manager 2024 SU4 SR1 and earlier versions; mitigation requires update to version 2024 SU5 or later. CIS reports no evidence of in-the-wild exploitation at the time of publication, but the authentication-bypass nature of the primary flaw makes this a high-priority patch for any organisation running affected versions, particularly those managing sensitive endpoints across government or critical infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-1602, CVE-2026-1603 (KEV)

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-endpoint-manager-could-allow-for-authentication-bypass_2026-013

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9fbacc0e-9f47-53ff-a440-3fd78639b032/ivanti-endpoint-manager-authentication-bypass-and-sql-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup