Ivanti Patches Critical Flaws Across Enterprise Security Products
Ivanti released September updates fixing six critical RCE flaws in Neurons for ITSM plus authentication bypasses in Sentry and EPMM; no exploitation seen.
Ivanti's September 2026 updates fix eight flaws in Neurons for ITSM, six of them critical remote code execution bugs with CVSS scores up to 9.9, including missing authorization issues (CVE-2026-12647, CVE-2026-12645, CVE-2026-12646) and deserialization flaws (CVE-2026-12650, CVE-2026-12744, CVE-2026-12745). Sentry releases R10.8.2, R10.7.3, and R10.6.4 patch CVE-2026-83527, an unauthenticated high-severity authentication bypass, while EPMM versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 fix the authenticated bypass CVE-2026-18851. Ivanti says it is not aware of any exploitation in the wild. Citrix separately patched two medium-severity flaws in Workspace app for Windows.
- Neurons for ITSM received fixes for eight flaws, six critical RCE bugs with CVSS up to 9.9.
- Only CVE-2026-12744 and CVE-2026-12745 are exploitable without authentication.
- Sentry patches CVE-2026-83527 and EPMM patches CVE-2026-18851, both authentication bypasses.
- Ivanti says none of the vulnerabilities have been exploited in the wild.
- Fixes shipped in September 2026 updates for ITSM versions 2025.2 through 2026.1.
- CVEs
- CVE-2026-12647CVE-2026-12645CVE-2026-12646CVE-2026-12650CVE-2026-12744CVE-2026-12745CVE-2026-12651CVE-2026-12648CVE-2026-83527CVE-2026-18851
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12744 | Unauthenticated Deserialization RCE in Ivanti Neurons for ITSM | 9.8 group max | 2% | ||
| CVE-2026-18851 | Missing Authorization in Ivanti Endpoint Manager Mobile Allows Admin Privilege Escalation | 8.8 | 1% | ||
| CVE-2026-83527 | Authentication Bypass in Ivanti Sentry Grants Remote Admin Access | 8.1 | 1% |
From the original article
2 min read at securityweek.com
Six critical vulnerabilities in Neurons for ITSM could enable remote code execution, while Sentry and EPMM received patches for authentication bypass flaws. The post Ivanti Patches Critical Flaws Across Enterprise Security Products appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.