Blog · 2026-10-19 · Gardience Engineering

Ivanti Endpoint Manager alternative for servers

Ivanti Endpoint Manager flaws keep landing on CISA's actively exploited list. What to look for in the tool that controls every server, and how to replace it for Windows and Linux servers.

On March 9, 2026, CISA added an Ivanti Endpoint Manager flaw, CVE-2026-1603, to its Known Exploited Vulnerabilities catalog: attackers with network access could pull credentials from the core server without signing in. It is not the first Ivanti product on that list.

This is not about one vendor. The tool that manages every machine is the one attackers want most: whoever controls it controls the fleet. If you are re-evaluating after an advisory like this, start with these requirements.

What to demand from the tool that controls every server#

• No anonymous paths in. Every route requires an authenticated session or a scoped key, and is tested for that on every release.
• No single person can push a change everywhere. Two-person approval for changes, and no admin account that silently bypasses it.
• Least privilege for the tool itself. The automation identity can run only the functions it needs; arbitrary command execution is off unless someone with root on the server turns it on.
• No inbound management ports on endpoints. Agents that dial out instead of listeners on every machine.
• A tamper-evident record. Every action and every machine's result in a hash-chained log that forwards to your SIEM, so an intruder cannot quietly erase what they did.
• Release discipline. Signed releases, an SBOM per image, and published security testing.

Replacing it for servers#

Ivanti Endpoint Manager is broad: desktops, laptops, software distribution, inventory. Many teams use it for servers too. For the server side, Gardience is a supported console on open-source Salt for Windows and Linux, designed around the list above:

• Every route checked for sign-in and per-role privileges by an automated attack suite before each release is signed (OWASP ZAP, nuclei, TLS scans, and published Salt exploits).
• Two-person approval, change windows, locks, and time-limited break-glass access; no admin bypass.
• Command execution off by default on new installs, enforced by Salt itself.
• Agents dial out to the server; nothing listens on the endpoints.
• A tamper-evident audit log with SIEM forwarding and a signed evidence pack.
• Patching and a scored STIG/CIS-aligned baseline for Windows Server 2016 to 2025, Windows 10 and 11, and major Linux distributions.

Gardience is not a desktop software-distribution suite. If you use Ivanti mainly for laptops and desktops, compare desktop tools; if servers are the worry, Gardience covers them.

Questions#

What is CVE-2026-1603?#

An Ivanti Endpoint Manager vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on March 9,

1. Attackers with network access could retrieve credentials from the core server without signing in. Check Ivanti's advisory for affected versions and fixes.

Should we patch or replace?#

Patch now, always. Replacement is a separate, slower decision about whether the tool's design and track record fit the level of control it has over your fleet.

Does Gardience manage desktops?#

It manages Windows 10 and 11 as well as servers for patching and compliance, but it is not a desktop software-distribution suite.