Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE Attacks
Ivanti patched ten CVEs across EPMM, Neurons for ITSM and Sentry, including critical unauthenticated deserialization RCE; no active exploitation reported.
68
CVE-2026-12745
Unauthenticated RCE via Deserialization in Ivanti Neurons for ITSM
- CVSS 3.1
- 9.8 critical
- EPSS
- 2%p81
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-12745 is a deserialization of untrusted data flaw (CWE-502) in Ivanti Neurons for ITSM, the vendor's enterprise IT service management platform. A remote, unauthenticated attacker can send crafted serialized data to a vulnerable instance over the network, which the server deserializes without validation. Successful exploitation results in arbitrary code execution on the server, with critical confidentiality, integrity, and availability impact (CVSS 3.1: 9.8). All deployments of Neurons for ITSM before version 2026.2 are affected, including instances published to the internet for self-service access. As of this analysis there is no known exploitation and no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 2.1% probability of exploitation within 30 days (81st percentile).
What to do: Upgrade Ivanti Neurons for ITSM to version 2026.2 or later. Until patched, restrict network exposure of the ITSM server (especially any self-service portals reachable from the internet) and monitor for anomalous traffic, prioritizing patching of internet-facing instances first since no authentication is required.
| Product | Affected |
|---|---|
| Ivanti Neurons for ITSM | all versions before 2026.2 |
Estimated exposure
moderate≈ thousands of enterprise deployments (order of 1k–10k instances) — Neurons for ITSM is licensed per organization and enterprise ITSM platforms of this class typically run in a few thousand customer environments, many of which also expose self-service portals to the internet, so this is an estimate from…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- Vendors
- ivanti
- Products
- neurons for itsm
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
3 storiesIvanti Patches Critical Flaws Across Enterprise Security Products
Ivanti released September updates fixing six critical RCE flaws in Neurons for ITSM plus authentication bypasses in Sentry and EPMM; no exploitation seen.
62
Ivanti Patches 10 EPMM, Neurons for ITSM and Sentry Flaws Enabling RCE and Admin Access
Ivanti patches 10 flaws in EPMM, Neurons for ITSM, and Sentry, including two 9.8-rated unauthenticated RCEs in ITSM.
60