{"id":1663,"date":"2026-09-15T12:47:29","date_gmt":"2026-09-15T07:17:29","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1663"},"modified":"2026-09-16T16:31:45","modified_gmt":"2026-09-16T11:01:45","slug":"ivanti-september-2026-security-patches-2","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/ivanti-september-2026-security-patches-2\/","title":{"rendered":"Ivanti Vulnerabilities: Critical ITSM RCE and Admin Access Flaws"},"content":{"rendered":"

Introduction<\/h2>\n

Security tools need the same patching discipline as the systems they protect.<\/p>\n

On September 8, 2026, Ivanti released updates for ten vulnerabilities affecting Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM). The Ivanti vulnerabilities could enable remote code execution, authentication bypass, or administrative privilege escalation, depending on the affected product.<\/p>\n

Two Neurons for ITSM flaws and the Sentry vulnerability do not require authentication. That makes exposed or broadly accessible management interfaces particularly important to identify and patch. Ivanti had not reported evidence of exploitation before disclosure.<\/p>\n \t\t

\r\n \t\t\tWho is Ivanti?<\/span> \t\t\t \t\t\t\t

\r\n \t\t\t\t\tIvanti is an enterprise software vendor whose products support IT service management, endpoint management, mobile access, and related security operations. The products affected by the September 2026 advisories occupy privileged positions within enterprise environments.<\/p>\n

Neurons for ITSM manages service requests and IT workflows. EPMM provides mobile device and application management, while Sentry acts as a gateway between managed mobile devices and protected enterprise resources.<\/p>\n

These roles make access control and code execution flaws operationally significant. A successful attacker could potentially gain control over the affected product or interfere with administrative functions. However, these advisories describe software vulnerabilities rather than a confirmed attack campaign, and no threat actor has been attributed to them. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t\n

What happened?<\/h2>\n

Ivanti disclosed separate security advisories for Neurons for ITSM, Sentry, and EPMM. The flaws have different authentication requirements and should not be treated as a single attack chain.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Incident detail<\/th>\nVerified information<\/th>\n<\/tr>\n<\/thead>\n
Disclosure date<\/td>\nSeptember 8, 2026<\/td>\n<\/tr>\n
Threat actor<\/td>\nNo threat actor or group has been identified<\/td>\n<\/tr>\n
Affected organizations<\/td>\nOrganizations operating vulnerable Neurons for ITSM, Sentry, or EPMM deployments<\/td>\n<\/tr>\n
Initial access<\/td>\nNetwork access to the affected product is required; authentication requirements vary by vulnerability<\/td>\n<\/tr>\n
Social engineering<\/td>\nNone reported or required by the disclosed vulnerability conditions<\/td>\n<\/tr>\n
Credential or MFA impact<\/td>\nNo credential theft or MFA bypass was reported<\/td>\n<\/tr>\n
Persistence<\/td>\nNo persistence method was reported<\/td>\n<\/tr>\n
Data or access at risk<\/td>\nPotential server-side code execution or administrative access, depending on the product<\/td>\n<\/tr>\n
Confirmed exploitation<\/td>\nIvanti reported no evidence that the flaws had been exploited before disclosure<\/td>\n<\/tr>\n
Confirmed impact<\/td>\nThe advisories confirm vulnerable software and potential impact, not a successful breach or data theft<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Eight Neurons for ITSM vulnerabilities<\/h2>\n

Neurons for ITSM received fixes for eight vulnerabilities: six critical flaws and two high-severity flaws. All eight could allow a remote attacker to execute arbitrary code on the affected server.<\/p>\n

CVE-2026-12744 and CVE-2026-12745 are critical deserialization-of-untrusted-data vulnerabilities with CVSS scores of 9.8. A remote attacker can exploit these flaws without authentication.<\/p>\n

CVE-2026-12645, CVE-2026-12646, and CVE-2026-12647 are missing-authorization vulnerabilities. CVE-2026-12650 is another deserialization flaw. These four critical vulnerabilities require authentication and carry CVSS scores of 9.9.<\/p>\n

CVE-2026-12648 and CVE-2026-12651 are high-severity deserialization vulnerabilities. Both require authentication and have CVSS scores of 8.8.<\/p>\n

Ivanti applied the fixes to its cloud-hosted Neurons for ITSM environments. Customers operating affected on-premises versions from the 2025.2 through 2026.1 release branches should install the relevant September 2026 security patches.
\n

<\/div>

What Are the Key Differences Between Signature-Based and Behaviour-Based Threat Detection?<\/h4>

Compare signature- and behavior-based detection to understand their strengths, limitations, and use cases.<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div><\/p>\n

Ivanti Sentry CVE-2026-83527<\/h2>\n

Ivanti Sentry CVE-2026-83527 is a high-severity authentication bypass vulnerability rated 8.1. It affects Sentry deployments managed through EPMM or Neurons for MDM.<\/p>\n

A remote, unauthenticated attacker could exploit the flaw to obtain administrative-level access. This potential impact makes the vulnerability especially relevant to organizations that expose Sentry to untrusted networks.<\/p>\n

Ivanti addressed the flaw in Sentry R10.8.2, R10.7.3, and R10.6.4. Administrators should confirm their release branch and install the corresponding fixed version.<\/p>\n

Ivanti EPMM CVE-2026-18851<\/h2>\n

Ivanti EPMM CVE-2026-18851 is a high-severity missing-authorization vulnerability rated 8.8. Unlike the Sentry flaw, it requires the attacker to authenticate before attempting exploitation.<\/p>\n

A remote authenticated attacker could exploit the vulnerability to elevate privileges to an administrator role. Therefore, describing it simply as an authentication bypass would be misleading: the weakness affects authorization after authentication.<\/p>\n

Ivanti fixed the flaw in EPMM 12.10.0.0, 12.9.0.2, and 12.8.0.4. Organizations running earlier builds within the affected release branches should upgrade to the appropriate fixed version.<\/p>\n

Why this matters<\/h2>\n

ITSM, mobile management, and access gateways hold more authority than standard business applications. They may control device configurations, administrative workflows, application access, or connections to protected resources.<\/p>\n

As a result, a flaw in the management layer can create device management risk beyond the vulnerable server itself. Administrative access could let an attacker alter configurations or interfere with security operations. Remote code execution could also affect the confidentiality, integrity, and availability of the underlying server.<\/p>\n

Traditional endpoint controls cannot correct a vulnerability in an unpatched Ivanti product. Organizations need layered controls: vendor patching for the affected platform, restricted access to management interfaces, strong administrator authentication, least privilege, centralized logging, and monitoring for unexpected changes.<\/p>\n

The absence of reported exploitation should not delay remediation. It only means that exploitation had not been identified when the advisories were published.
\n

\n
\n
\n
\n \"Hexnode-Unified-Endpoint-management_Brochures\"\n <\/div>\n <\/div>\n
\n
\n Feature Resource \n <\/h5>\n

\n Why Hexnode UEM\n <\/h4>\n

\n Here's why UEM implementation might be the best thing for your organization right now\n <\/p>\n \n Get the Brochure\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section><\/p>\n

How Hexnode UEM Mitigates Admin Endpoint Risks<\/h2>\n

Hexnode UEM: Maintain a separate endpoint security baseline<\/h3>\n

Hexnode UEM<\/a> helps organizations harden administrator workstations used to access Ivanti ITSM, Sentry, and EPMM consoles. Based on the device platform and management mode, administrators can enforce password requirements, encryption settings, application restrictions, and operating system update policies, helping mitigate credential theft and unauthorized console access.<\/p>\n

Application blocklists and allowlists can limit which software users can run on supported devices. This can reduce exposure to unauthorized applications on workstations used to access privileged management consoles.<\/p>\n

Hexnode\u2019s policy and compliance reports can show whether assigned configurations were applied successfully and identify non-compliant endpoints. Administrators can also scan managed devices to refresh information such as installed applications, system configurations, and current compliance status. In addition, Hexnode can enforce compliance-gated network access, preventing non-compliant or unpatched administrator devices from connecting to enterprise management networks.<\/p>\n

Audit reports provide a record of activity within the Hexnode console, including policy changes, app-management events, technician activity, and remote actions. These records can support internal reviews when security teams investigate unexpected management changes.<\/p>\n

However, Hexnode UEM does not remediate Ivanti Sentry, EPMM, or Neurons for ITSM vulnerabilities. Organizations must still apply Ivanti\u2019s product-specific patches and monitor the affected infrastructure. Hexnode provides an additional endpoint governance layer rather than a substitute for server patching or application security monitoring.<\/p>\n

What security teams should do next<\/h2>\n

Start by creating an inventory of every Neurons for ITSM, Sentry, and EPMM deployment, including internally hosted instances. Record the installed release branch, exposure level, business owner, and patch status.<\/p>\n

Apply the appropriate enterprise security patches and verify that services return to a healthy state. Where immediate patching is not possible, restrict management interfaces to trusted networks and authorized administrators. These controls reduce exposure but do not replace the vendor update.<\/p>\n

Next, review administrator accounts, recent configuration changes, authentication records, and server logs for unexplained activity. Remove unnecessary accounts and validate that privileged users have only the access required for their roles.<\/p>\n

Audit administrator endpoints via Hexnode UEM to enforce mandatory OS and browser patching, strict application allowlisting, and console-access baselines.
\n

<\/div><\/div>
Try\u202fHexnode\u202fFree for 14 Days\u202f\u202f\u202f\u202f\u202f\u202f\u202f <\/h5>

Strengthen endpoint security and compliance with Hexnode. Start your free trial today.<\/p>