- Vendor / Project
- Ivanti
- Product
- Endpoint Manager (EPM)
- Date added
- Mar 9, 2026
- Due date
- Mar 23, 2026
- Known ransomware use
- Unknown
- CWEs
- CWE-288
Description
Ivanti Endpoint Manager (EPM) contains an authentication bypass using an alternate path or channel vulnerability that could allow a remote unauthenticated attacker to leak specific stored credential data.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.