CVE-2026-109412

Description

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

Overview

State: PUBLISHED
Assigner (CNA): ivanti
CVSS severity: CRITICAL
CVSS score: 9.9 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Effective score: 9.9 / 10 CRITICAL source: CNA overview
CWE(s): CWE-749
Reserved: 2026-10-12
Published: 2026-10-13 16:23 UTC
Last updated: 2026-10-13 16:23 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109412.json
Linked Threat: CVE-2026-109412 — CVE-2026-109412

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-10-13 17:17:28 UTC
NVD last modified: 2026-10-14 16:08:15 UTC
NVD CVSS v3.1: 9.9 / 10 CRITICAL source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability subscore: 3.1 / 10
Impact subscore: 6.0 / 10
EPSS score: 0.0087 (probability of exploitation in next 30 days)
EPSS percentile: 57.92% vs all CVEs — higher = more likely to be exploited, as of 2026-10-14

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-98916
Assigner: ivanti
Published: Oct 13, 2026, 4:23:41 PM
Updated: Oct 13, 2026, 4:23:41 PM
EUVD base score (CVSS 3.1): 9.9 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EUVD-reported EPSS: 0.0000
Vendors: Ivanti
Products: Neurons Patch for Intune (patch: Fix Date: September 16, 2026)
Aliases: GHSA-4j6p-29h2-w33f

ENISA description: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

EUVD references (1)

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026

Affected products (1)

Vendor	Product	Versions	Platforms
Ivanti	Neurons Patch for Intune	`Fix Date: September 16, 2026` (unaffected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-109412 · Ivanti · CVSS 9.9 · CVE Brief Analyst Report

web:cvebrief.com

Remediation Immediate Action: Update Ivanti Neurons Patch for Intune to the version released on or after September 16, 2026 , as specified in the vendor security advisory. Proactive Monitoring: Review system and application access logs for unusual patterns of API requests or unexpected access to administrative endpoints.

2026-10-14 15:10 UTC
CVE-2026-109412 - Ivanti Neurons Patch for Intune Information ...

web:cvefeed.io

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

2026-10-14 15:10 UTC
CVE-2026-109412: Neurons Patch For Intune Vulnerability | CVETodo

web:cvetodo.com

CVE-2026-109412 is a CVSS 9.9 critical-severity vulnerability in Neurons Patch For Intune. See exploitation status, patch guidance, and technical details.

2026-10-14 15:10 UTC
CVE-2026-109412 | CyberSIXT

web:cybersixt.com

CVE-2026-109412 : CVSS 9.9 critical. An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitiv

2026-10-14 15:10 UTC
CVE-2026-109412 - Exploits & Severity - Feedly

web:feedly.com

A vulnerability identified as problematic has been detected in Ivanti Neurons Patch for Intune . This impacts an unknown function. This manipulation causes information disclosure. This vulnerability is handled as CVE-2026-109412 . The attack can be initiated remotely. There is not any exploit available.

2026-10-14 15:10 UTC
Security Advisory Ivanti Neurons Patch for Intune October 2026 (CVE ...

web:hub.ivanti.com

Mitigation or Workaround Out of an abundance of caution, Ivanti recommends that customers rotate the client secret associated with the Microsoft Entra ID App Registration used for Intune publication. This vulnerability only impacts the secret for the Patch for Intune Application Publisher Credential.

2026-10-14 15:10 UTC
CVE-2026-109412 - vulnerability database | Vulners.com

web:vulners.com

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information . The vulnerability is associated with CWE-749 (Exposed Dangerous Method or Function) and carries ...

2026-10-14 15:10 UTC
CVE-2026-109412 - An exposed dangerous endpoint in Ivanti Neurons…

web:www.cyber-defence.io

CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

2026-10-14 15:10 UTC
CVE-2026-109412 - An exposed dang - nmmapper.com

web:www.nmmapper.com

CVE-2026-109412 - An exposed dang An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allow An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

2026-10-14 15:10 UTC
CVE-2026-109412: Neurons Patch for Intune Vulnerability

web:www.strix.ai

CVE-2026-109412 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information..

2026-10-14 15:10 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-109412.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Neurons Patch for Intune",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "Fix Date: September 16, 2026",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.&nbsp;"
            }
          ],
          "value": "An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749 Exposed dangerous method or function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T16:23:41.494Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2026-109412",
    "datePublished": "2026-10-13T16:23:41.494Z",
    "dateReserved": "2026-10-12T15:25:11.718Z",
    "dateUpdated": "2026-10-13T16:23:41.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}