Ivanti Patches 10 EPMM, Neurons for ITSM and Sentry Flaws Enabling RCE and Admin Access
Ivanti patches 10 flaws in EPMM, Neurons for ITSM, and Sentry, including two 9.8-rated unauthenticated RCEs in ITSM.
Ivanti released fixes for 10 vulnerabilities across Endpoint Manager Mobile, Neurons for ITSM, and Sentry, and said it was not aware of active exploitation at disclosure. The most severe are CVE-2026-12744 and CVE-2026-12745, unauthenticated deserialization RCEs rated 9.8 in Neurons for ITSM, alongside authenticated deserialization and missing-authorization RCEs rated up to 9.9. CVE-2026-18851 is an 8.8-rated EPMM privilege escalation to administrator, and CVE-2026-83527 is an 8.1-rated unauthenticated authentication bypass in Sentry granting administrative access. Ivanti said the ITSM weaknesses were found using large language models; Cloud/SaaS fixes shipped August 9, 2026, and on-premises patches are available from September 2026.
- Two unauthenticated 9.8 deserialization RCEs (CVE-2026-12744, CVE-2026-12745) affect Neurons for ITSM
- Missing-authorization flaws rated 9.9 allow authenticated attackers arbitrary code execution
- CVE-2026-18851 (8.8) lets authenticated EPMM users escalate to administrator
- CVE-2026-83527 (8.1) bypasses Sentry authentication for administrative access
- ITSM weaknesses found using LLMs; on-premises patch available September 2026
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12744 | Unauthenticated Deserialization RCE in Ivanti Neurons for ITSM | 9.8 group max | 2% | ||
| CVE-2026-18851 | Missing Authorization in Ivanti Endpoint Manager Mobile Allows Admin Privilege Escalation | 8.8 | 1% | ||
| CVE-2026-83527 | Authentication Bypass in Ivanti Sentry Grants Remote Admin Access | 8.1 | 1% |
From the original article
2 min read at gbhackers.com
Ivanti has released security updates addressing 10 vulnerabilities in Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry. The vulnerabilities include several critical remote code execution (RCE) issues in Neurons for ITSM, an authentication bypass in Sentry that could grant administrative access, and a privilege escalation flaw in EPMM. Ivanti Patches 10 EPMM Flaws The […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.