Ivanti Patches Critical Flaws Across Enterprise Security Products

Ivanti on Tuesday announced security updates that address vulnerabilities rated critical and high severity in its Neurons for ITSM, Sentry, and Endpoint Manager Mobile (EPMM) products.

Neurons for ITSM received fixes for the largest number of security defects. Of the eight bugs, six are critical-severity issues that could lead to remote code execution, Ivanti warns.

These include CVE-2026-12647, CVE-2026-12645, and CVE-2026-12646 (CVSS score of 9.9/10), described as missing authorization issues; and CVE-2026-12650 (CVSS score of 9.9/10), CVE-2026-12744, and CVE-2026-12745 (CVSS score of 9.8/10), described as deserialization of untrusted data weaknesses.

The remaining two bugs, tracked as CVE-2026-12651 and CVE-2026-12648, are high-severity deserialization of untrusted data defects also leading to remote code execution.

According to Ivanti’s advisory, only CVE-2026-12744 and CVE-2026-12745 can be exploited without authentication.

Ivanti Patches Critical Flaws Across Enterprise Security Products

Other newsrooms on this story

Related reading

Ivanti EPM Update Patches Remotely Exploitable Flaws

Kritische Schadcode-Lücken bedrohen Ivanti Neurons for ITSM

Ivanti: Max severity Sentry flaw allows code execution as root

Ivanti tells Sentry customers to patch now as critical bugs hit 10.0 and 9.9

Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege…

Max severity Ivanti Sentry vulnerability now exploited in attacks