CISA Flags Active Ivanti EPM Exploitation
The Cybersecurity and Infrastructure Security Agency added a high-severity Ivanti Endpoint Manager vulnerability to its Known Exploited Vulnerabilities catalog on March 10, 2026. The agency confirmed attackers are actively exploiting the flaw in the wild.
CISA issued a binding operational directive requiring all federal agencies to patch affected systems within 21 days. The vulnerability allows attackers to bypass authentication mechanisms in Ivanti's endpoint management platform.
Federal Agencies Face Mandatory Patching
All U.S. federal civilian executive branch agencies running Ivanti Endpoint Manager must comply with the patching deadline. The directive applies to any government systems using the affected EPM versions.
Private sector organizations using Ivanti EPM should also prioritize patching, though they're not bound by the federal mandate. The Hacker News reported that multiple vulnerabilities across different vendors were added to the catalog simultaneously.
Exploitation Confirmed in Government Systems
CISA's decision to add the vulnerability stems from evidence of active exploitation targeting government infrastructure. The agency's Known Exploited Vulnerabilities catalog only includes flaws with confirmed in-the-wild abuse.
Federal agencies must patch by March 31, 2026, or disconnect affected systems from their networks. Security Affairs noted this addition was part of a broader update that included vulnerabilities from SolarWinds and Omnissa Workspace One.
