Ivanti on Tuesday announced patches for over a dozen vulnerabilities in Endpoint Manager (EPM), including issues that were first disclosed in October 2025.
In a new advisory, the company warns of a high-severity bug and a medium-severity flaw resolved in EPM, both of which could be exploited remotely.
Tracked as CVE-2026-1603, the high-severity weakness is described as an authentication bypass leading to the exposure of credential data.
The medium-severity flaw, tracked as CVE-2026-1602, is an SQL injection security defect that could allow authenticated attackers to read arbitrary data from the database.
Both issues were resolved in EPM 2024 SU5, which also includes fixes for 11 medium-severity vulnerabilities that Ivanti warned about in October.
The issues were reported to Ivanti in November 2024 and were publicly disclosed by Trend Micro’s Zero Day Initiative (ZDI) as ‘0day’, although they were not technically zero-days. Successful exploitation of these bugs could allow attackers to escalate their privileges and execute arbitrary code remotely.
In November 2025, Ivanti rolled out fixes for two of the bugs, both high-severity weaknesses, and has now released patches for the remaining flaws.
The company says it is not aware of any of these vulnerabilities being exploited in the wild, but users are advised to update to EPM 2024 SU5 as soon as possible.
As Ivanti warned in October, EPM version 2022 has reached End of Life (EOL) and is no longer receiving security updates. Users should migrate to a supported EPM version.
On Tuesday, Ivanti also updated its advisory for two recently disclosed Endpoint Manager Mobile (EPMM) vulnerabilities that have been exploited as zero-days.
Tracked as CVE-2026-1281 and CVE-2026-1340 (CVSS score of 9.8) and leading to unauthenticated remote code execution (RCE), they were exploited to deploy web shells and reverse shells for persistence, Ivanti said in late January.
Last week, the company updated its advisory to include indicators of compromise (IoCs) and a detection script, and has now included guidance on false positives.
Related: Fortinet Patches High-Severity Vulnerabilities
Related: 6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 Updates
Related: SAP Patches Critical CRM, S/4HANA, NetWeaver Vulnerabilities
Related: Ivanti EPM Update Patches Critical Remote Code Execution Flaw
