Loading story…
Ivanti released fixes for ten vulnerabilities across Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry. The most urgent Neurons for ITSM issues are unauthenticated deserialization flaws CVE-2026-12744 and CVE-2026-12745, which can enable remote code execution on versions before 2026.2; additional missing-authorization and deserialization flaws, including CVE-2026-12646, CVE-2026-12647, CVE-2026-12648, CVE-2026-12650, and CVE-2026-12651, allow low-privileged authenticated users to execute code. Ivanti patched its cloud/SaaS ITSM environments and directed on-premises customers on versions 2025.2 through 2026.1 to apply the September security updates.
EPMM vulnerability CVE-2026-18851 is a CVSS 8.8 missing-authorization flaw that lets a remote authenticated attacker elevate privileges to administrator; affected customers should upgrade to 12.10.0.0, 12.9.0.2, or 12.8.0.4. Ivanti Sentry vulnerability CVE-2026-83527 permits unauthenticated attackers to gain administrative-level access in releases before R10.8.2, R10.7.3, and R10.6.4. Ivanti and CISA reported no known exploitation at disclosure, but organizations should prioritize remediation of internet-exposed Neurons for ITSM deployments and review all applicable vendor advisories.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-897 covering affected Ivanti Endpoint Manager Mobile, Neurons for ITSM, and Sentry versions. It urged administrators to review Ivanti advisories and apply available updates.
CISA SSVC records dated September 8 assessed the listed EPMM, Neurons for ITSM, and Sentry CVEs as having no known exploitation and total technical impact. The records marked CVE-2026-12744 and CVE-2026-12745 as automatable, while the other referenced vulnerabilities were assessed as not automatable.
Ivanti stated it had no evidence that any of the ten disclosed vulnerabilities had been actively exploited before disclosure. For CVE-2026-18851, it also said there was no known public exploitation or associated public indicators of compromise.
Ivanti released EPMM fixes 12.10.0.0, 12.9.0.2, and 12.8.0.4 for CVE-2026-18851, and Sentry fixes R10.8.2, R10.7.3, and R10.6.4 for CVE-2026-83527. It directed Neurons for ITSM on-premises customers running releases 2025.2 through 2026.1 to apply September 2026 security patches.
Ivanti disclosed ten CVEs affecting Endpoint Manager Mobile, Neurons for ITSM, and Sentry. The issues included EPMM privilege escalation (CVE-2026-18851), eight Neurons for ITSM flaws including unauthenticated RCE vulnerabilities CVE-2026-12744 and CVE-2026-12745, and Sentry authentication bypass CVE-2026-83527.
Ivanti patched all Neurons for ITSM cloud and SaaS landscapes, with no customer action required.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
19 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourceacn.gov.it
Open sourcesecurityweek.com
Open sourcemalware.news
Open sourcecvefeed.io
Open sourcehub.ivanti.com
Open sourcehub.ivanti.com
Open sourcehub.ivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti issued security updates for multiple enterprise products, including **Ivanti Connect Secure**, **Policy Secure**, and **Ivanti Neurons for ITSM**, as the company continued remediation across its remote access and IT service management portfolio. The Neurons for ITSM fixes arrived in version **2025.4** and addressed **CVE-2026-4913** and **CVE-2026-4914**, affecting version **2025.3** and earlier in both on-premises and cloud deployments; Ivanti said cloud instances had already been patched and urged on-premises customers to upgrade through the Ivanti License System. According to Ivanti, **CVE-2026-4913** is an improper path protection flaw that could allow a remote authenticated attacker to retain access after an administrator disables the account, while **CVE-2026-4914** is a stored **XSS** issue that could let an authenticated attacker access limited data from other users’ sessions. Ivanti said it was not aware of active exploitation and had no indicators of compromise for the Neurons flaws, while its separate advisory for Connect Secure and Policy Secure signaled additional security remediation affecting those products.
Jun 29, 2026
Ivanti disclosed five vulnerabilities in **Endpoint Manager Mobile (EPMM)**, including **`CVE-2026-6973`**, an authenticated remote code execution flaw with a **CVSS 7.2** score that the company said has been exploited against a very limited number of customers. The issue requires administrative authentication, and Ivanti said organizations that rotated credentials after the earlier January flaws **`CVE-2026-1281`** and **`CVE-2026-1340`** have significantly reduced risk. CERT-SE separately highlighted that **`CVE-2026-6973`** was added to **CISA’s Known Exploited Vulnerabilities** catalog. The advisory also covers **`CVE-2026-5786`**, **`CVE-2026-5787`**, **`CVE-2026-5788`**, and **`CVE-2026-7821`**, with Ivanti reporting no known exploitation for those issues at disclosure time. According to the vendor and CERT-SE, the additional flaws include weaknesses that can enable administrative privilege gain and unauthenticated certificate access, while **`CVE-2026-7821`** affects only environments using **Apple Device Enrollment**. Ivanti urged customers to rotate administrative credentials and upgrade EPMM to **12.6.1.1**, **12.7.0.1**, or **12.8.0.1**; it also released compatible **Sentry** versions, while stating that Sentry itself is not affected.
Jul 24, 2026
Ivanti released security updates for eight vulnerabilities across **Cloud Services Application (CSA)**, **Connect Secure (ICS)**, **Policy Secure (IPS)**, **Desktop and Server Management (DSM)**, **Sentry**, and **Patch SDK**, including five rated critical. The most severe issues affect CSA, ICS, and IPS and could allow **SQL injection**, **remote code execution**, **authentication bypass**, and ultimately full system compromise, while a separate advisory also addressed **`CVE-2024-7572`** in DSM. Additional flaws can lead to denial of service, unauthorized system changes, file deletion, and bypass of security mechanisms. Ivanti said Patch SDK exposure also affects dependent products including **Endpoint Manager**, **Security Controls**, **Patch for Configuration Manager**, **Neurons for Patch Management**, and **Neurons Agent Platform**, and urged customers to upgrade immediately to supported fixed versions for ICS, IPS, DSM, and other impacted platforms.
Jul 23, 2026