Ivanti Patches Critical Flaws Across Enterprise Security Products
Ivanti released security updates addressing multiple critical vulnerabilities in its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) products. Six critical remote code execution flaws in Neurons for ITSM were fixed, including missing authorization and deserialization of untrusted data issues. Two authentication bypass vulnerabilities affecting Sentry and EPMM were also patched. The vulnerabilities were resolved in specific versions released in September 2026. Ivanti is not aware of any active exploitation in the wild.
AI Analysis
Technical Summary
Ivanti patched eight vulnerabilities in Neurons for ITSM, including six critical remote code execution flaws caused by missing authorization and deserialization of untrusted data (CVE-2026-12647, CVE-2026-12645, CVE-2026-12646, CVE-2026-12650, CVE-2026-12744, CVE-2026-12745) with CVSS scores up to 9.9. Two additional high-severity deserialization issues (CVE-2026-12651, CVE-2026-12648) were also fixed. Only CVE-2026-12744 and CVE-2026-12745 can be exploited without authentication. Ivanti also patched authentication bypass vulnerabilities in Sentry (CVE-2026-83527) and EPMM (CVE-2026-18851), with the latter requiring authentication. These fixes were included in Neurons for ITSM versions 2025.2, 2025.3, 2025.4, and 2026.1, with 2026.2 scheduled for release on September 21, 2026. Sentry and EPMM patches were released in versions R10.8.2, R10.7.3, R10.6.4 and 12.10.0.0, 12.9.0.2, 12.8.0.4 respectively. No active exploitation is known.
Potential Impact
Successful exploitation of the critical vulnerabilities in Neurons for ITSM could allow remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The authentication bypass flaws in Sentry and EPMM could allow unauthorized or authenticated attackers to gain administrative privileges, increasing the risk of unauthorized access and control. No evidence of exploitation in the wild has been reported.
Mitigation Recommendations
Ivanti has released official security updates addressing all identified vulnerabilities. Users of Ivanti Neurons for ITSM should upgrade to versions 2025.2, 2025.3, 2025.4, 2026.1, or later, including the upcoming 2026.2 release. Sentry users should update to versions R10.8.2, R10.7.3, or R10.6.4. EPMM users should apply versions 12.10.0.0, 12.9.0.2, or 12.8.0.4. Applying these patches is the recommended and effective mitigation. Ivanti is not aware of any active exploitation, but timely patching is advised.
Ivanti Patches Critical Flaws Across Enterprise Security Products
Description
Ivanti released security updates addressing multiple critical vulnerabilities in its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) products. Six critical remote code execution flaws in Neurons for ITSM were fixed, including missing authorization and deserialization of untrusted data issues. Two authentication bypass vulnerabilities affecting Sentry and EPMM were also patched. The vulnerabilities were resolved in specific versions released in September 2026. Ivanti is not aware of any active exploitation in the wild.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Ivanti patched eight vulnerabilities in Neurons for ITSM, including six critical remote code execution flaws caused by missing authorization and deserialization of untrusted data (CVE-2026-12647, CVE-2026-12645, CVE-2026-12646, CVE-2026-12650, CVE-2026-12744, CVE-2026-12745) with CVSS scores up to 9.9. Two additional high-severity deserialization issues (CVE-2026-12651, CVE-2026-12648) were also fixed. Only CVE-2026-12744 and CVE-2026-12745 can be exploited without authentication. Ivanti also patched authentication bypass vulnerabilities in Sentry (CVE-2026-83527) and EPMM (CVE-2026-18851), with the latter requiring authentication. These fixes were included in Neurons for ITSM versions 2025.2, 2025.3, 2025.4, and 2026.1, with 2026.2 scheduled for release on September 21, 2026. Sentry and EPMM patches were released in versions R10.8.2, R10.7.3, R10.6.4 and 12.10.0.0, 12.9.0.2, 12.8.0.4 respectively. No active exploitation is known.
Potential Impact
Successful exploitation of the critical vulnerabilities in Neurons for ITSM could allow remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The authentication bypass flaws in Sentry and EPMM could allow unauthorized or authenticated attackers to gain administrative privileges, increasing the risk of unauthorized access and control. No evidence of exploitation in the wild has been reported.
Mitigation Recommendations
Ivanti has released official security updates addressing all identified vulnerabilities. Users of Ivanti Neurons for ITSM should upgrade to versions 2025.2, 2025.3, 2025.4, 2026.1, or later, including the upcoming 2026.2 release. Sentry users should update to versions R10.8.2, R10.7.3, or R10.6.4. EPMM users should apply versions 12.10.0.0, 12.9.0.2, or 12.8.0.4. Applying these patches is the recommended and effective mitigation. Ivanti is not aware of any active exploitation, but timely patching is advised.
Technical Details
- Classification
- {"confidence":0.93,"severitySource":"stated","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/","fetched":true,"fetchedAt":"2026-09-09T10:37:20.910Z","wordCount":994}
Threat ID: 6aa136e0acd9273b492bef9e
Added to database: 09/09/2026, 10:37:20 UTC
Last enriched: 09/09/2026, 10:37:28 UTC
Last updated: 09/09/2026, 10:50:52 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.