Ivanti has announced a series of critical security vulnerabilities affecting three major enterprise solutions: Endpoint Manager Mobile, Neurons for ITSM, and Sentry. These vulnerabilities pose significant risks, including privilege escalation and remote code execution (RCE), potentially impacting organizations worldwide.
Disclosed on September 8, 2026, these vulnerabilities span ten unique CVEs, several of which hold critical ratings. This wide-ranging exposure highlights the importance of addressing security issues within Ivanti’s mobile device management and IT service management platforms.
Detailed Analysis of EPMM Vulnerabilities
The first security advisory pertains to CVE-2026-18851, a high-severity flaw in Ivanti’s Endpoint Manager Mobile (EPMM). This missing authorization defect, assigned a CVSS score of 8.8, allows remote authenticated attackers to elevate privileges to administrator level. Affected versions include 12.9.0.1 and earlier, 12.8.0.3 and earlier, with remediation provided in updates 12.10.0.0, 12.9.0.2, and 12.8.0.4.
Ivanti has strongly recommended that organizations implement these patches to mitigate potential exploitation risks, particularly for internet-connected instances of EPMM.
Neurons for ITSM: Critical Security Concerns
Ivanti’s Neurons for ITSM has been identified as having eight distinct vulnerabilities. Among these, CVE-2026-12744 and CVE-2026-12745 are the most severe, both involving the deserialization of untrusted data (CWE-502). These flaws could be exploited by unauthenticated attackers to execute arbitrary code, each carrying a critical rating of 9.8.
Additional deserialization vulnerabilities, CVE-2026-12651, CVE-2026-12650, and CVE-2026-12648, necessitate authentication but still enable RCE. Three missing authorization flaws, CVE-2026-12645, CVE-2026-12646, and CVE-2026-12647, also allow authenticated RCE, each rated at 9.9 in severity. Ivanti has patched these issues in cloud deployments with on-premises updates scheduled.
Impacts on Ivanti Sentry and Response Measures
Another significant vulnerability, CVE-2026-83527, affects Ivanti Sentry, managed via EPMM and Neurons for MDM. This authentication bypass flaw, with a CVSS score of 8.1, enables remote unauthenticated attackers to gain administrative access. Fixed versions R10.8.2, R10.7.3, and R10.6.4 have been released to address this issue.
Ivanti has confirmed no evidence of active exploitation of these vulnerabilities prior to their disclosure. Nonetheless, due to the historical targeting of Ivanti’s management infrastructure, security teams are advised to prioritize patching, especially for Neurons for ITSM instances exposed to the internet.
The company credits advanced AI models integrated into its security workflows for the discovery of these vulnerabilities, underscoring the role of AI in enhancing cybersecurity measures.
