Ivanti Neurons Patch for Intune Authentication Information Leak

CVE-2026-109412 is a CVSS 9.9 critical vulnerability in Ivanti Neurons Patch for Intune that can expose sensitive authentication information to an attacker. The flaw was patched on October 14, 2026 as part of Ivanti’s October advisory batch.

Ivanti Neurons Patch for Intune is an endpoint patch management module that integrates with Microsoft Intune to automate patch deployment across managed devices. The platform holds authentication credentials and service tokens used to communicate with Microsoft cloud infrastructure, the Ivanti platform, and managed endpoints. A vulnerability that leaks that authentication material gives an attacker the ability to impersonate the patch management service, which may translate to lateral movement or device compromise across the managed fleet.

The CVSS 9.9 score reflects both the severity of the exposed data (authentication credentials used in privileged operations) and the breadth of the downstream impact: patch management platforms operate with elevated privileges on every endpoint they manage, and stolen credentials can extend an attacker’s reach across all of them.

Ivanti released a patch on October 14, 2026. The October batch also addresses CVE-2026-104935, the actively exploited Connect Secure zero-day with a CISA October 16 remediation deadline, and CVE-2026-106042, a credential-capture flaw in Ivanti Xtraction. Administrators managing multiple Ivanti products should apply all three patches in the same maintenance window.

For broader context on Ivanti’s October patch batch, see Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday.

FAQ

What authentication information is at risk?

Ivanti’s advisory describes sensitive authentication information leaking to an attacker, but has not detailed the specific credential types in the initial disclosure. In the context of a patch management platform integrated with Microsoft Intune, the at-risk material likely includes service account credentials or API tokens used to communicate with Intune and managed endpoints. Check Ivanti’s full advisory for specific affected components and data types.

Does this require an authenticated attacker?

Fortinet’s October batch includes an authenticated-attacker requirement for some of its SQL injection CVEs; Ivanti’s advisory for CVE-2026-109412 does not specify the same constraint in the summary. A CVSS 9.9 score is consistent with a low or no privilege requirement on the attack side. Review the full advisory for the complete CVSS vector breakdown.

What should we do now?

Apply the October 14 patch from Ivanti. If your organization is also running Ivanti Connect Secure, the CISA October 16 remediation deadline for CVE-2026-104935 takes the most immediate priority, but CVE-2026-109412 should be closed in the same window.