A critical authentication bypass vulnerability in Ivanti Endpoint Manager, tracked as CVE-2026-1603, is being actively exploited by attackers, according to the US Cybersecurity and Infrastructure Security Agency (CISA). This flaw, which affects EPM versions prior to 2024 SU5, enables remote, unauthenticated attackers to leak stored credential data. CISA has warned that this vulnerability, patched on February 9, is now being exploited in the wild1. Additionally, the agency has updated its directive related to two Cisco Catalyst SD-WAN flaws that were recently fixed after being used in zero-day attacks. The active exploitation of CVE-2026-1603 underscores the need for prompt patching, particularly for organizations using affected Ivanti EPM versions. So what matters to practitioners is that they must prioritize patching this vulnerability to prevent potential credential leaks and subsequent attacks.