Ivanti Patches Critical Flaws Across Enterprise Security Products
Source SecurityWeek
Mentioned vulnerabilities
Rated by Threat Radar
What to do
AI-suggested
Ivanti has released official security updates addressing all identified vulnerabilities. Users of Ivanti Neurons for ITSM should upgrade to versions 2025.2, 2025.3, 2025.4, 2026.1, or later, including the upcoming 2026.2 release. Sentry users should update to versions R10.8.2, R10.7.3, or R10.6.4. EPMM users should apply versions 12.10.0.0, 12.9.0.2, or 12.8.0.4. Applying these patches is the recommended and effective mitigation. Ivanti is not aware of any active exploitation, but timely patching is advised.
Description
Ivanti released security updates addressing multiple critical vulnerabilities in its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) products. Six critical remote code execution flaws in Neurons for ITSM were fixed, including missing authorization and deserialization of untrusted data issues. Two authentication bypass vulnerabilities affecting Sentry and EPMM were also patched. The vulnerabilities were resolved in specific versions released in September 2026. Ivanti is not aware of any active exploitation in the wild.
Impact
Successful exploitation of the critical vulnerabilities in Neurons for ITSM could allow remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The authentication bypass flaws in Sentry and EPMM could allow unauthorized or authenticated attackers to gain administrative privileges, increasing the risk of unauthorized access and control. No evidence of exploitation in the wild has been reported.
Summary
Ivanti patched eight vulnerabilities in Neurons for ITSM, including six critical remote code execution flaws caused by missing authorization and deserialization of untrusted data (CVE-2026-12647, CVE-2026-12645, CVE-2026-12646, CVE-2026-12650, CVE-2026-12744, CVE-2026-12745) with CVSS scores up to 9.9. Two additional high-severity deserialization issues (CVE-2026-12651, CVE-2026-12648) were also fixed. Only CVE-2026-12744 and CVE-2026-12745 can be exploited without authentication. Ivanti also patched authentication bypass vulnerabilities in Sentry (CVE-2026-83527) and EPMM (CVE-2026-18851), with the latter requiring authentication. These fixes were included in Neurons for ITSM versions 2025.2, 2025.3, 2025.4, and 2026.1, with 2026.2 scheduled for release on September 21, 2026. Sentry and EPMM patches were released in versions R10.8.2, R10.7.3, R10.6.4 and 12.10.0.0, 12.9.0.2, 12.8.0.4 respectively. No active exploitation is known.