CVE-2026-109412

CVE-2026-109412 is an exposed dangerous endpoint (CWE-749) in Ivanti Neurons Patch for Intune. A remote attacker who already has low-privilege authentication can reach the endpoint over the network with no user interaction and leak sensitive authentication information. The CVSS 3.1 score is 9.9 (critical) with changed scope and high impact to confidentiality, integrity, and availability, so stolen credentials could be reused against systems beyond the vulnerable component. Organizations that run Ivanti Neurons Patch for Intune are affected; the source data does not name a version range. There is no known public proof-of-concept and the issue is not listed in CISA KEV.

What to do: Apply the vendor fix for Ivanti Neurons Patch for Intune as soon as a patched release is identified, and until then restrict network access to the product so only trusted administrators can reach it. Rotate any authentication material that may have been exposed through the endpoint and review access logs for unexpected authenticated calls. Do not wait for a public proof-of-concept; the CVSS score indicates leaked credentials could affect systems beyond the patch component.