Ivanti's September 2026 security update (blog, 8 Sep 2026) discloses flaws in Neurons for ITSM, Sentry and Endpoint Manager Mobile (EPMM).

According to Ivanti's CVE records (published 8 Sep 2026 UTC), Neurons for ITSM before 2026.2 is affected by missing-authorization flaws CVE-2026-12645, CVE-2026-12646 and CVE-2026-12647 and deserialization flaw CVE-2026-12650, each letting a remote authenticated attacker execute arbitrary code on the server (CVSS 9.9), and by deserialization flaws CVE-2026-12744 and CVE-2026-12745, which let a remote unauthenticated attacker execute arbitrary code (CVSS 9.8). Sentry before R10.8.2, R10.7.3 and R10.6.4 has authentication bypass CVE-2026-83527, letting a remote unauthenticated attacker gain administrative access (CVSS 8.1), and EPMM before 12.10.0.0, 12.9.0.2 and 12.8.0.4 has missing-authorization flaw CVE-2026-18851, letting a remote authenticated attacker escalate to admin (CVSS 8.8).

Ivanti's blog says it has no evidence of exploitation in the wild and that no other Ivanti products are affected. (sources: Ivanti September 2026 Security Update blog; CVE records)

Correction (30 Oct 2026): removed a bug count and fixed-build details that only SecurityWeek, which this desk cannot read, gave; CVE details are now credited to Ivanti's own CVE records. (source: CVE records)