Ivanti has released security advisories for ten vulnerabilities across Endpoint Manager Mobile (EPMM), Neurons for ITSM, and Sentry, including flaws that could enable unauthenticated remote code execution (RCE) and administrative access.
The disclosures, published September 8, 2026, span mobile device management, IT service management, and gateway infrastructure used in enterprise environments.
The EPMM advisory addresses CVE-2026-18851, a high-severity missing authorization vulnerability with a CVSS score of 8.8. Classified as CWE-862, the flaw allows a remote authenticated attacker to elevate privileges to full administrator-level access.
Ivanti Patches 10 Flaws Across EPMM, Neurons ITSM and Sentry
Affected EPMM releases include versions 12.9.0.1 and earlier, 12.8.0.3 and earlier, and builds prior to 12.10.0.0. Ivanti has issued fixes in versions 12.10.0.0, 12.9.0.2, and 12.8.0.4.
The most serious issues affect Ivanti Neurons for ITSM, where eight vulnerabilities can lead to server-side code execution.
CVE-2026-12744 and CVE-2026-12745 are critical deserialization-of-untrusted-data flaws, tracked under CWE-502. Each carries a CVSS score of 9.8 and can be exploited remotely without authentication to execute arbitrary code on a vulnerable Neurons for ITSM server.
Three further deserialization flaws, CVE-2026-12648, CVE-2026-12650, and CVE-2026-12651, require an authenticated attacker but may also result in RCE.
Ivanti additionally identified CVE-2026-12645, CVE-2026-12646, and CVE-2026-12647 as missing authorization vulnerabilities that allow authenticated users to execute code remotely. Each of the three flaws has a critical CVSS score of 9.9.
Ivanti said it patched the cloud and SaaS editions of Neurons for ITSM across all landscapes on August 9, 2026, with no action required from customers.
On-premises customers using versions 2025.2 through 2026.1 should install the September 2026 security patches. Version 2026.2 is scheduled for release on September 21.
Notably, Ivanti credited advanced large language models integrated into its engineering and product-security workflows with helping uncover the ITSM vulnerabilities.
The Sentry advisory covers CVE-2026-83527, an authentication bypass issue rated 8.1. The CWE-288 flaw affects Sentry deployments managed through EPMM and Neurons for MDM, allowing a remote unauthenticated attacker to gain administrative-level access.
| Product | CVE | Severity / CVSS | Vulnerability and impact | Fixed version / action |
|---|---|---|---|---|
| EPMM | CVE-2026-18851 | High / 8.8 | Missing authorization (CWE-862); authenticated privilege escalation to full admin | Upgrade to 12.10.0.0, 12.9.0.2, or 12.8.0.4 |
| Neurons for ITSM | CVE-2026-12744 | Critical / 9.8 | Deserialization of untrusted data (CWE-502); unauthenticated RCE | Cloud patched; apply September patches on-premises |
| Neurons for ITSM | CVE-2026-12745 | Critical / 9.8 | Deserialization of untrusted data (CWE-502); unauthenticated RCE | Cloud patched; apply September patches on-premises |
| Neurons for ITSM | CVE-2026-12645 | Critical / 9.9 | Missing authorization; authenticated RCE | Cloud patched; apply September patches on-premises |
| Neurons for ITSM | CVE-2026-12646 | Critical / 9.9 | Missing authorization; authenticated RCE | Cloud patched; apply September patches on-premises |
| Neurons for ITSM | CVE-2026-12647 | Critical / 9.9 | Missing authorization; authenticated RCE | Cloud patched; apply September patches on-premises |
| Neurons for ITSM | CVE-2026-12648 | High / Critical | Deserialization of untrusted data; authenticated RCE | Cloud patched; apply September patches on-premises |
| Neurons for ITSM | CVE-2026-12650 | High / Critical | Deserialization of untrusted data; authenticated RCE | Cloud patched; apply September patches on-premises |
| Neurons for ITSM | CVE-2026-12651 | High / Critical | Deserialization of untrusted data; authenticated RCE | Cloud patched; apply September patches on-premises |
| Ivanti Sentry | CVE-2026-83527 | High / 8.1 | Authentication bypass (CWE-288); unauthenticated administrative access | Upgrade to R10.8.2, R10.7.3, or R10.6.4 |
Ivanti said it has found no evidence that any of the ten flaws were exploited before disclosure.
Nevertheless, organizations should prioritize internet-exposed Neurons for ITSM instances and Sentry gateways, apply available updates promptly, and review administrator accounts, access logs, and anomalous server-side activity for signs of compromise.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
, Neurons for ITSM, and Sentry, including flaws that could enable unauthenticated remote code execution (RCE) and administrative access.){kind=link}