Ivanti Neurons Patch for Intune CVE-2026-109412 (CVSS 9.9): exposed endpoint let a remote authenticated attacker leak sensitive authentication information; fixed server-side 16 Sep, rotate Entra ID client secret
Ivanti's 13 October 2026 security update discloses CVE-2026-109412 in Ivanti Neurons Patch for Intune, a cloud service that publishes patches into Microsoft Intune. The CVE record describes an exposed dangerous endpoint (CWE-749) that lets a remote authenticated attacker leak sensitive authentication information. Ivanti rates it Critical 9.9 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Environments using versions prior to the 16 September 2026 server-side fix are listed as affected; Ivanti states the cloud service was fixed for all environments on that date, so no customer software update is required. Out of caution Ivanti recommends rotating the Microsoft Entra ID app-registration client secret used for Intune publication. Ivanti says it is not aware of exploitation. This is separate from the Connect Secure zero-day (CVE-2026-104935) disclosed the same day. Primary: Ivanti Neurons Patch for Intune security advisory; secondary: Canadian Centre for Cyber Security AV26-1035 and CVE record.
- Product
- Ivanti Neurons Patch for Intune (cloud)
- Versions
- Affected: environments prior to the 16 September 2026 server-side fix. Fixed for all cloud environments on 16 Sep 2026; no customer package update required. Rotate the Entra ID app-registration client secret used for Intune publication.
- CVSS
- (Ivanti CNA, CVSS 3.1 Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Exploited in Australia?
- unknown
- Patch to
- Confirm your Neurons Patch for Intune tenant is on the post-16 Sep 2026 fixed service. Rotate the Microsoft Entra ID app-registration client secret used for Intune publication, and review recent Intune publishing activity for unexpected use of that app.
Primary: Ivanti — Security Advisory Ivanti Neurons Patch for Intune October 2026 (CVE-2026-109412) · Vendor: Ivanti — October 2026 Security Update (13 Oct 2026) · CVE: CVE-2026-109412, CVE-2026-104935 · Canadian Centre for Cyber Security — Ivanti security advisory AV26-1035 (13 Oct 2026)