Ivanti EPMM, Neurons, Sentry patch RCE flaws
Multiple deserialization, missing authorization, and auth bypass vulnerabilities in Ivanti EPMM, Neurons for ITSM, and Sentry could allow arbitrary code execution; no exploitation reported yet.
MS-ISAC has issued an advisory covering multiple vulnerabilities across three Ivanti product lines: Endpoint Manager Mobile (EPMM), Neurons for ITSM (cloud and on-prem), and Sentry. The most severe issues are deserialization-of-untrusted-data flaws in Neurons for ITSM that allow both unauthenticated and authenticated remote attackers to execute arbitrary code on the server, along with missing authorization vulnerabilities that also enable code execution. Additional flaws include a missing authorization bug in EPMM allowing privilege escalation to admin, and an authentication bypass in Sentry allowing unauthenticated attackers to gain administrative access.
Affected versions span EPMM 12.9.0.1 and prior, Neurons for ITSM cloud version 2026.2 and on-prem versions 2025.2 through 2026.1, and Sentry R10.8.1 and prior. Ivanti has already patched its cloud environments and is urging on-premises customers to update immediately. There is no current evidence of in-the-wild exploitation, but given Ivanti products' history as frequent targets for exploitation of internet-facing management infrastructure, defenders should treat patching as urgent, particularly for unauthenticated pre-auth RCE and auth-bypass conditions.
Defenders should prioritize patching Neurons for ITSM (deserialization RCEs), Sentry (auth bypass), and EPMM (privilege escalation) per Ivanti's fixed versions, apply least-privilege principles, monitor for anomalous authentication and privilege escalation events on these platforms, and ensure vulnerability scanning and network segmentation controls are in place for internet-facing Ivanti deployments.
Mentioned in this report
Detection guidance
Ivanti EPMM Privilege Escalation via Unauthorized Admin Access
Detects privilege escalation attempts in Ivanti EPMM exploiting missing authorization to grant admin rights without proper authorization checks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti EPMM Privilege Escalation via Unauthorized Admin Access
description: Detects suspicious privilege escalation activity in Ivanti EPMM processes,
particularly role/permission elevation operations that bypass authorization controls.
Targets missing authorization vulnerability allowing non-admin users to escalate
to admin.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_epmm:
ParentImage|endswith:
- \AppConsole.exe
- \EMCConsole.exe
Image|endswith:
- \java.exe
- \javaw.exe
CommandLine|contains:
- admin
- role
- privilege
selection_registry:
TargetObject|contains:
- HKLM\\Software\\Ivanti\\EPMM
- HKLM\\Software\\EMCONSOLE
Details|contains:
- admin
- elevated
filter_legitimate_update:
CommandLine|contains:
- update
- patch
- install
condition: (selection_epmm or selection_registry) and not filter_legitimate_update
falsepositives:
- Legitimate Ivanti EPMM administrative updates and role provisioning
- Authorized privilege elevation during deployment or maintenance windows
level: high
id: c08888ee-22c0-5f97-a8de-9716d8b7e052
status: experimental
author: Vorant
Ivanti Sentry Authentication Bypass - Unauthenticated Admin Access
Detects unauthenticated requests to Ivanti Sentry administrative endpoints or session establishment without prior authentication, indicating auth-bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti Sentry Authentication Bypass - Unauthenticated Admin Access
description: Detects unauthenticated HTTP/HTTPS requests to Ivanti Sentry administrative
endpoints that succeed without proper session establishment. Targets authentication
bypass vulnerability allowing unauthenticated attackers to gain admin access.
tags:
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection_sentry_admin:
DestinationHostname|contains: sentry
Url|contains:
- /admin
- /api/admin
- /management
- /console
HttpResponseCode: 200
selection_no_auth:
AuthenticationProvided: false
UserAgent|contains:
- curl
- python
- powershell
- wget
filter_status_page:
Url|contains:
- /status
- /health
- /ping
condition: selection_sentry_admin and selection_no_auth and not filter_status_page
falsepositives:
- Health check probes and monitoring systems accessing public status endpoints
- Authorized API integrations with bearer token in Authorization header (requires
additional log context)
level: high
id: 05dcd57b-c3d4-524e-a4d5-c9444bbc6cb7
status: experimental
author: Vorant
Ivanti Neurons for ITSM Deserialization RCE - Untrusted Data Processing
Detects suspicious Java deserialization activity in Ivanti Neurons for ITSM processes, particularly spawning unexpected child processes from deserialization handlers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ivanti Neurons for ITSM Deserialization RCE - Untrusted Data Processing
description: Detects arbitrary process execution from Ivanti Neurons for ITSM Java
process, indicative of deserialization-of-untrusted-data RCE exploitation. Targets
unauthenticated and authenticated pre-auth code execution flaws.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_neurons_java:
ParentImage|endswith:
- \java.exe
- \javaw.exe
ParentCommandLine|contains:
- Neurons
- itsm
- neurons-app
selection_suspicious_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \bash.exe
- \sh.exe
- \nc.exe
- \ncat.exe
CommandLine|contains:
- whoami
- ipconfig
- systeminfo
- wget
- curl
filter_legitimate_scripts:
CommandLine|contains:
- .bat
- .ps1
- script
condition: selection_neurons_java and selection_suspicious_child and not filter_legitimate_scripts
falsepositives:
- Legitimate system monitoring or diagnostic scripts spawned from Neurons application
logic
- Authorized backup or compliance utilities invoking shell commands
level: high
id: 5c85716d-0397-5071-a07a-0276c90c5078
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ivanti-products-could-allow-for-arbitrary-code-execution_2026-093
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free