Ivanti Neurons for ITSM Patches 8 Vulnerabilities Including 6 Critical: Unauthenticated Deserialization to RCE
Ivanti patched 8 Neurons for ITSM vulnerabilities. Two unauthenticated deserialization bugs at CVSS 9.8 yield direct RCE. This batch was found with help from an internal LLM. Cloud is auto-patched.
Ivanti published a set of advisories on September 8 covering 8 vulnerabilities in Neurons for ITSM. Six are critical, including two deserialization RCEs that need no credentials. Ivanti also disclosed that this batch was found with help from an internally integrated large language model—AI-assisted vuln discovery is compressing the window for both sides. Cloud and SaaS are already auto-patched; on-prem must patch manually.
Incident overview
Unauthenticated deserialization bugs CVE-2026-12744 and CVE-2026-12745 (both CWE-502, CVSS 9.8) let a remote attacker, with no login, no privileges, and no user interaction, send a malicious serialized payload over the network and execute arbitrary code on the server. Default config is enough.
Three missing-authorization bugs CVE-2026-12645, CVE-2026-12646, CVE-2026-12647 (all CWE-862, CVSS 9.9): a low-privilege authenticated user bypasses authz and hits protected server-side functions, also arbitrary code execution. CVE-2026-12650 (9.9, scope changed) and CVE-2026-12648, CVE-2026-12651 (both 8.8) are authenticated deserialization RCEs.
Same advisory wave: Sentry auth bypass CVE-2026-83527 (8.1, unauthenticated admin) and EPMM privilege escalation CVE-2026-18851 (8.8).
Technical detail and impact
"Authenticated" is not low risk. ITSM has a large account base—employees, support, service accounts, contractors, external users. One low-priv account phished or credential-stuffed is enough to walk missing-authz or deserialization to server RCE, then ticket/asset data and the internal network. At disclosure Ivanti reported no in-the-wild use and no public PoC. That is the patch window. Last year Ivanti Sentry CVE-2026-10520 landed in CISA KEV from in-the-wild use; this product line is watched.
Remediation
- Cloud/SaaS: Ivanti auto-applied the fix to all cloud environments on August 9. No action.
- On-prem: instances on 2025.2, 2025.3, 2025.4, or 2026.1 — get the September security patch from the Ivanti License Server (ILS) and install it. 2026.2 is scheduled for September 21 and will include all fixes.
- Sentry: upgrade to R10.8.2, R10.7.3, or R10.6.4.
- EPMM: upgrade to 12.10.0.0, 12.9.0.2, or 12.8.0.4.
- Temporary mitigation: if you cannot patch now, put the ITSM instance behind a firewall or VPN. Do not expose it to the internet.
- After the fact: audit low-priv accounts that can reach ITSM and recently created accounts; review auth logs and anomalous server-side process execution; confirm no existing compromise.
Sources
- Ivanti advisory: Neurons for ITSM Multiple CVEs
- BugsToday: Ivanti Neurons Has a 9.9 RCE
- OffSeq Threat Radar: Ivanti Patches Critical Flaws Across Enterprise Security Products