Ivanti EPMM, Neurons, Sentry patch RCE flaws
Multiple deserialization, missing authorization, and auth bypass vulnerabilities in Ivanti EPMM, Neurons for ITSM, and Sentry could allow arbitrary code execution; no exploitation reported yet.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 10 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
MS-ISAC has issued an advisory covering multiple vulnerabilities across three Ivanti product lines: Endpoint Manager Mobile (EPMM), Neurons for ITSM (cloud and on-prem), and Sentry. The most severe issues are deserialization-of-untrusted-data flaws in Neurons for ITSM that allow both unauthenticated and authenticated remote attackers to execute arbitrary code on the server, along with missing authorization vulnerabilities that also enable code execution. Additional flaws include a missing authorization bug in EPMM allowing privilege escalation to admin, and an authentication bypass in Sentry allowing unauthenticated attackers to gain administrative access.
Affected versions span EPMM 12.9.0.1 and prior, Neurons for ITSM cloud version 2026.2 and on-prem versions 2025.2 through 2026.1, and Sentry R10.8.1 and prior. Ivanti has already patched its cloud environments and is urging on-premises customers to update immediately. There is no current evidence of in-the-wild exploitation, but given Ivanti products' history as frequent targets for exploitation of internet-facing management infrastructure, defenders should treat patching as urgent, particularly for unauthenticated pre-auth RCE and auth-bypass conditions.
Defenders should prioritize patching Neurons for ITSM (deserialization RCEs), Sentry (auth bypass), and EPMM (privilege escalation) per Ivanti's fixed versions, apply least-privilege principles, monitor for anomalous authentication and privilege escalation events on these platforms, and ensure vulnerability scanning and network segmentation controls are in place for internet-facing Ivanti deployments.
Mentioned in this report
Detection guidance
Ivanti Neurons for ITSM Deserialization RCE - Untrusted Data Processing
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious Java deserialization activity in Ivanti Neurons for ITSM processes, particularly spawning unexpected child processes from deserialization handlers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti Neurons for ITSM Deserialization RCE - Untrusted Data Processing
description: Detects arbitrary process execution from Ivanti Neurons for ITSM Java
process, indicative of deserialization-of-untrusted-data RCE exploitation. Targets
unauthenticated and authenticated pre-auth code execution flaws.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_neurons_java:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentCommandLine|contains:
- Neurons
- itsm
- neurons-app
selection_suspicious_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \bash.exe
- \sh.exe
- \nc.exe
- \ncat.exe
CommandLine|contains:
- whoami
- ipconfig
- systeminfo
- wget
- curl
filter_legitimate_scripts:
CommandLine|contains:
- .bat
- .ps1
- script
condition: selection_neurons_java and selection_suspicious_child and not filter_legitimate_scripts
falsepositives:
- Legitimate system monitoring or diagnostic scripts spawned from Neurons application
logic
- Authorized backup or compliance utilities invoking shell commands
level: high
id: 5c85716d-0397-5071-a07a-0276c90c5078
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-arbitrary-code-execution_2026-093
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs