# Ivanti September 2026 Patch Batch: 10 CVEs Across EPMM, Neurons for ITSM, and Sentry (CVE-2026-12744/12745 Unauthenticated Deserialization RCE, CVE-2026-12645-12647 Missing Authorization RCE, CVE-2026-18851 EPMM Privilege Escalation, CVE-2026-83527 Sentry Auth Bypass)

> Ivanti disclosed 10 vulnerabilities across three enterprise products in its September 2026 security update: EPMM (1), Neurons for ITSM (8), and Sentry (1). The most critical findings include two unauthenticated deserialization remote code execution flaws in Neurons for ITSM (CVE-2026-12744, CVE-2026-12745, CVSS 9.8 each), three authenticated missing-authorization RCE flaws enabling arbitrary code execution (CVE-2026-12645-12647, CVSS 9.9 each), and an authentication bypass granting unauthenticated administrative-level access to Sentry gateway appliances (CVE-2026-83527, CVSS 8.1). While Ivanti reports no confirmed active exploitation prior to disclosure, its edge and mobile management infrastructure has been aggressively targeted by state-sponsored threat actors throughout 2026 — including three prior disclosure batches (January, May, June) with direct CISA KEV additions. Cloud/SaaS Neurons for ITSM instances were remediated on August 9, 2026; on-premises customers must apply the September 2026 patches urgently.

- **Published:** 2026-09-08T00:00:00Z
- **Last reviewed:** 2026-09-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2396
- **ID:** TL-2026-2396
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-18851, CVE-2026-12744, CVE-2026-12745, CVE-2026-12645, CVE-2026-12646, CVE-2026-12647, CVE-2026-12648, CVE-2026-12650, CVE-2026-12651, CVE-2026-83527

## Description

On September 8, 2026, Ivanti publicly disclosed 10 distinct security vulnerabilities spanning three enterprise infrastructure products as part of its September 2026 security update. The vulnerabilities range from CVSS 8.1 to 9.9 and include multiple classes of remotely exploitable flaws affecting the Endpoint Manager Mobile (EPMM), Neurons for ITSM (on-premises), and Sentry gateway products. Ivanti's security advisory states there is 'no evidence of active exploitation' prior to disclosure, though the company warns that its products have been under sustained threat-actor targeting throughout 2026.

CVE-2026-18851 (CVSS 8.8, HIGH) affects Ivanti Endpoint Manager Mobile (EPMM), the enterprise mobile device management platform formerly known as MobileIron Core. The vulnerability is a missing authorization flaw (CWE-862) that allows a remote authenticated attacker to escalate their privileges to full administrative access. Affected versions include EPMM 12.9.0.1 and earlier, and 12.8.0.3 and earlier. Fixed versions are 12.10.0.0, 12.9.0.2, and 12.8.0.4. EPMM sits at the network perimeter managing every enrolled mobile device, making administrative compromise particularly dangerous — an attacker with admin access can push malicious policy, certificates, and configuration to the entire mobile fleet, effectively achieving an MDM takeover.

The Neurons for ITSM product received the largest share of fixes with 8 CVEs, all affecting the on-premises deployment (cloud/SaaS instances were silently patched on August 9, 2026). These break into three categories: (1) two unauthenticated deserialization remote code execution flaws, CVE-2026-12744 and CVE-2026-12745 (CVSS 9.8, CRITICAL, CWE-502), enabling a remote attacker with no authentication to execute arbitrary code on the ITSM application server by sending crafted serialized data; (2) three authenticated remote code execution flaws via missing authorization, CVE-2026-12645, CVE-2026-12646, and CVE-2026-12647 (CVSS 9.9, CRITICAL, CWE-862), where a low-privilege authenticated user can escalate to execute arbitrary code on the server with a scope-changed impact affecting connected systems; and (3) three authenticated deserialization remote code execution flaws, CVE-2026-12648 (CVSS 8.8, HIGH), CVE-2026-12650 (CVSS 9.9, CRITICAL), and CVE-2026-12651 (CVSS 8.8, HIGH), all CWE-502 deserialization vulnerabilities requiring authentication. Notably, CVE-2026-12650 carries a scope-changed (S:C) modifier, indicating the deserialization can impact resources beyond the vulnerable component. Ivanti disclosed that these eight ITSM vulnerabilities were identified using 'advanced large language models integrated into its product security' — representing a novel AI-assisted vulnerability discovery methodology in enterprise software security.

The final vulnerability, CVE-2026-83527 (CVSS 8.1, HIGH), affects Ivanti Sentry, the secure gateway appliance that manages connections between Ivanti products and backend infrastructure. It is an authentication bypass (CWE-288) enabling a remote unauthenticated attacker to gain administrative-level access to the Sentry appliance. The vulnerability was discovered by security researcher btaol of Aquila Sec Lab and is fixed in Sentry versions R10.8.2, R10.7.3, and R10.6.4. Sentry appliances that are managed through EPMM or Neurons for MDM may have restricted network access that reduces the practical attack surface.

The broader context for this disclosure is critical for SOC analysis: Ivanti products have been under sustained, sophisticated attack throughout 2026. In January 2026, UNC5221 (a suspected China-nexus APT) exploited CVE-2026-1281 and CVE-2026-1340 as zero-days against EPMM, achieving pre-auth RCE. The May 2026 advisory explicitly warned that attackers were chaining credentials harvested from those January breaches to compromise additional appliances — a credential chain that makes credential rotation as important as patching. In June 2026, CVE-2026-10520 (Sentry pre-auth root RCE, CVSS 10.0) and CVE-2026-10523 (Sentry auth bypass, CVSS 9.9) were disclosed and CVE-2026-10520 was added to CISA's Known Exploited Vulnerabilities catalog within 48 hours of disclosure. Across this period, Mandiant documented 15+ malware families (SPAWNANT, SPAWNMOLE, SPAWNSNAIL, SPAWNSLOTH, TRAILBLAZE, BRUSHFIRE, ZIPLINE, LIGHTWIRE, WARPWIRE, DRYHOOK, PHASEJAM) deployed against Ivanti appliances, including malware that survived factory resets and firmware upgrades.

SOC teams should treat these vulnerabilities with elevated urgency even absent confirmed exploitation, based on: (1) Ivanti's repeated targeting by state-sponsored actors in 2026, (2) the availability of mature public exploit frameworks for Java/.NET deserialization (CWE-502), (3) the direct applicability of credential-chaining techniques documented in prior Ivanti campaigns, and (4) the criticality of the affected products — MDM infrastructure, IT service management backends, and secure gateway appliances — as enterprise trust anchors. Defenders should immediately inventory all Ivanti EPMM, Sentry, and Neurons for ITSM deployments, apply available patches, and audit for signs of prior compromise using established CISA and Mandiant detection guidance.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy

## Sources

- [Cyber Security News: Multiple Ivanti Vulnerabilities Disclosed](https://cybersecuritynews.com/multiple-ivanti-vulnerabilities/)
- [NVD: CVE-2026-18851 (EPMM Missing Authorization)](https://nvd.nist.gov/vuln/detail/CVE-2026-18851)
- [NVD: CVE-2026-12744 (Neurons ITSM Unauthenticated Deserialization RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-12744)
- [NVD: CVE-2026-12745 (Neurons ITSM Unauthenticated Deserialization RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-12745)
- [NVD: CVE-2026-12645 (Neurons ITSM Missing Authorization RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-12645)
- [NVD: CVE-2026-12646 (Neurons ITSM Missing Authorization RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-12646)
- [NVD: CVE-2026-12647 (Neurons ITSM Missing Authorization RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-12647)
- [NVD: CVE-2026-83527 (Sentry Authentication Bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-83527)
- [Ivanti Security Advisory: EPMM CVE-2026-18851](https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Endpoint-Manager-Mobile-CVE-2026-18851)
- [Ivanti Security Advisory: Neurons for ITSM Multiple CVEs](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs)
- [Ivanti Security Advisory: Sentry CVE-2026-83527](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-83527)
- [CISA AR25-261A: Malicious Listener for Ivanti EPMM Systems (IOCs and Detection)](https://www.cisa.gov/sites/default/files/2026-07/AR25-261A_MAR_Malicious_Listener_for_Ivanti_EPMM_Systems_2.pdf)
- [Ivanti June 2026 Security Update (CVE-2026-10520 Active Exploitation)](https://www.ivanti.com/blog/june-2026-security-update)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2396