Ivanti has revealed a set of serious security vulnerabilities in three of its flagship enterprise products—Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry—that could allow attackers to gain full administrative rights or perform remote code execution (RCE). These risks span missing authorization issues, deserialization of untrusted data, and authentication bypasses. The advisories, released on September 8, 2026, cover ten distinct CVEs, including several rated critical. These flaws expose a wide attack surface in Ivanti’s mobile and IT service management ecosystems.
What’s Vulnerable, and How Bad Is It
Endpoint Manager Mobile (EPMM) is impacted by CVE-2026-18851, a high-severity flaw (CVSS 8.8) tied to missing authorization (CWE-862). Attackers who have any level of remote authenticated access can exploit this to elevate privileges to full administrator. Versions 12.9.0.1 and earlier, 12.8.0.3 and earlier, as well as all builds before 12.10.0.0 are affected. Fixed versions are now available as EPMM 12.10.0.0, 12.9.0.2, and 12.8.0.4.
Neurons for ITSM carries the bulk of the risk, with eight separate CVEs disclosed—three of them rated at a maximum 9.9/10 criticality. Two of the flaws, CVE-2026-12744 and CVE-2026-12745, allow unauthenticated remote code execution through the deserialization of untrusted data (CWE-502), each scoring 9.8. Other deserialization bugs (e.g., CVE-2026-12651, CVE-2026-12650, CVE-2026-12648) allow authenticated RCE. Additionally, three missing authorization issues (CVE-2026-12645, CVE-12646, CVE-12647) permit authenticated attackers to execute code remotely, each with a 9.9 score.
If using the cloud/SaaS version of Neurons for ITSM, the patches were automatically applied on August 9, 2026—no action needed. On-premises customers running versions 2025.2 through 2026.1 must install the September 2026 patches. Version 2026.2 is set to receive its on-prem release on September 21.
Sentry & Other Risks
Also disclosed is CVE-2026-83527, affecting Ivanti Sentry instances managed via EPMM or Neurons for MDM. Classified under CWE-288, this authentication bypass flaw (CVSS 8.1) allows remote unauthenticated attackers to gain administrative privileges. Fixed versions include R10.8.2, R10.7.3, and R10.6.4.
Ivanti reports no indication that any of these vulnerabilities were exploited before disclosure. However, given that their edge and mobile management tools have long been attractive targets for attackers, organizations—especially those with internet-exposed Neurons for ITSM instances—are urged to prioritize updates immediately.
Summary Table:
- EPMM – privilege escalation via missing authorization (CVE-2026-18851), fixed in versions 12.10.0.0, 12.9.0.2, 12.8.0.4.
- Neurons for ITSM – multiple deserialization & missing authorization vulnerabilities (CVE-2026-12744, -12745, -12651, -12650, -12648, -12645, -12646, -12647); critical severities 9.8-9.9; cloud fixed, on-prem patches rolling out.
- Sentry – authentication bypass (CVE-2026-83527) allowing unauthenticated admin access; fixed in R10.8.2, R10.7.3, R10.6.4.
These flaws illustrate both the varied nature of modern enterprise vulnerabilities and the growing role of AI tools in finding them. Notably, some Neurons-for-ITSM bugs were uncovered using large language models embedded in Ivanti’s product security workflows. The use of AI doesn’t eliminate risk—but it appears to accelerate detection when done responsibly.
What This Means and What To Do:
- Organizations using EPMM, Neurons for ITSM, or Sentry must immediately assess whether they are running affected versions—particularly if their deployments are exposed to the internet.
- Apply patches straight away: fixed builds are already released for EPMM and Sentry; Neurons for ITSM cloud customers are safe; on-premises users need to catch up with September patches.
- Review access policies, especially for endpoints, API endpoints, and modules that handle deserialization or authorization logic.
- Monitor for unusual behavior or signs of compromise, even if patches are applied.
These advisories cover a wide range of threat vectors—from privilege escalation to remote code execution—and affect some of Ivanti’s most critical tools. The inclusion of AI in vulnerability discovery also points to an evolving landscape in security workflows.
