Ivanti EPMM, Neurons and Sentry Vulnerabilities Enable Privilege Escalation and RCE Attacks
Ivanti patched ten CVEs across EPMM, Neurons for ITSM and Sentry, including critical unauthenticated deserialization RCE; no active exploitation reported.
On September 8, 2026, Ivanti disclosed advisories covering ten CVEs in Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry. The most severe are two unauthenticated deserialization RCE flaws in Neurons for ITSM, CVE-2026-12744 and CVE-2026-12745 (CVSS 9.8), plus three missing-authorization RCE bugs rated 9.9 and three authenticated deserialization RCE flaws. EPMM has CVE-2026-18851 (CVSS 8.8), an authenticated privilege escalation flaw, and Sentry has CVE-2026-83527 (CVSS 8.1), an authentication bypass. Ivanti reports no evidence of active exploitation; cloud/SaaS ITSM was patched on August 9, 2026, while on-premises 2025.2 through 2026.1 require September 2026 patches.
- Ten CVEs disclosed across three Ivanti products, several rated critical
- Unauthenticated deserialization RCE in Neurons for ITSM (CVE-2026-12744/12745, CVSS 9.8)
- Ivanti credited LLM-assisted analysis in its product security workflow for discovery
- EPMM CVE-2026-18851 (8.8) allows admin escalation; Sentry CVE-2026-83527 (8.1) is an auth bypass
- No evidence of active exploitation; patch internet-exposed ITSM and Sentry promptly
- CVEs
- CVE-2026-18851CVE-2026-12744CVE-2026-12745CVE-2026-12651CVE-2026-12650CVE-2026-12648CVE-2026-12645CVE-2026-12646CVE-2026-12647CVE-2026-83527
- Vendors
- Ivanti
- Organizations
- Aquila Sec Lab
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12744 | Unauthenticated Deserialization RCE in Ivanti Neurons for ITSM | 9.8 group max | 2% | ||
| CVE-2026-18851 | Missing Authorization in Ivanti Endpoint Manager Mobile Allows Admin Privilege Escalation | 8.8 | 1% | ||
| CVE-2026-83527 | Authentication Bypass in Ivanti Sentry Grants Remote Admin Access | 8.1 | 1% |
From the original article
3 min read at cybersecuritynews.com
Ivanti has disclosed a wave of security advisories affecting three flagship enterprise products, Endpoint Manager Mobile, Neurons for ITSM, and Sentry, exposing organizations to risks ranging from privilege escalation to full remote code execution. The disclosures, published on September 8, 2026, cover ten distinct CVEs, several rated critical, underscoring the breadth of exposure across Ivanti’s […]
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.