Severity Daily

IT and AI security incidents, checked against the primary source

Tag: CVSS scope

  • Three Ivanti ITSM records share one description and one CWE, and two score 8.8 while the third scores 9.9

    Three Ivanti ITSM records share one description and one CWE, and two score 8.8 while the third scores 9.9

    Ivanti published eight Neurons for ITSM CVEs on September 8, 2026; three of them carry byte-identical descriptions and the same weakness class, two are scored 8.8 and the third 9.9, and the two flaws that need no login at all score below four that do.

    What happened

    Between 2:20 p.m. and 2:38 p.m. UTC on Tuesday, September 8, 2026, Ivanti published eight CVE records for Ivanti Neurons for ITSM, its IT service management platform. All eight reached NVD at 3:18 p.m. UTC. All eight cite a single reference: an advisory at hub.ivanti.com titled “Security Advisory Ivanti Neurons for ITSM Multiple CVEs.”

    Here is the set, as the records themselves state it:

    • CVE-2026-12744 and CVE-2026-12745 — CWE-502, deserialization of untrusted data. “A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.” CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
    • CVE-2026-12645, CVE-2026-12646, CVE-2026-12647 — CWE-862, missing authorization. “A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.” CVSS 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
    • CVE-2026-12650 — CWE-502. “A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.” CVSS 9.9, vector ...PR:L/UI:N/S:C/....
    • CVE-2026-12648 and CVE-2026-12651 — CWE-502. Description: identical, word for word, to CVE-2026-12650’s. CVSS 8.8, vector ...PR:L/UI:N/S:U/....

    Read that last pair against the one above it. Three records, published within ten minutes of each other by the same CNA, for the same product, in the same weakness class, whose English descriptions do not differ by a single character. Two are scored 8.8. One is scored 9.9. The entire 1.1-point gap is the scope metric: S:U on two, S:C on the third.

    The same metric produces the second oddity. The only two flaws in the set that require no authentication — the ones an anonymous attacker on the network can reach — are scored 9.8. Four flaws that require the attacker to hold credentials are scored 9.9. On paper, in a triage queue sorted by number, Ivanti’s pre-authentication remote code execution ranks below its post-authentication remote code execution.

    Every one of the eight records describes its affected versions the same way: a single version entry, 2026.2, marked unaffected, with defaultStatus: affected. No lower bound, no enumeration of shipping releases. The prose says “before 2026.2” and the structured data says the same thing in the widest possible way — everything that is not 2026.2.

    Ivanti published two further records the same day for other products: CVE-2026-18851, missing authorization in Endpoint Manager Mobile allowing an authenticated attacker to escalate to admin, 8.8, fixed in 12.10.0.0, 12.9.0.2 and 12.8.0.4; and CVE-2026-83527, an authentication bypass in Ivanti Sentry reachable by a remote unauthenticated attacker, 8.1, fixed in R10.8.2, R10.7.3 and R10.6.4. Both of those records name specific fixed builds. The ITSM records do not.

    Why it matters

    The scope metric is the single most contested field in CVSS v3.1, and this is what the argument looks like in production. S:C means the vulnerable component and the impacted component are different — the attacker breaks out of the security authority that was supposed to contain them. Ivanti has decided that four of these flaws do that and that the two unauthenticated ones do not, and it has decided that one deserialization bug does while two deserialization bugs described in exactly the same words do not.

    That may be entirely correct. Scope is a property of the code path, not of the sentence describing it, and three bugs can share a CWE, a product and a sentence while differing in whether the deserialized object escapes into a different security context. The problem is that the record gives a reader no way to tell. The description is the only substantive field in these records, and on three of them it is the same string. Whatever distinguishes CVE-2026-12650 from CVE-2026-12648 exists somewhere in Ivanti’s internal analysis and nowhere in the public record.

    This site has now seen the scope metric drive a ranking inversion twice in one day. This morning it was SAP, where a described crash scored 10.0 and a described takeover scored 9.8 on the strength of the same field. The pattern is not a vendor problem so much as a metric problem: scope is the one CVSS base metric that requires a judgment call about architecture rather than an observation about the attack, and it moves scores by more than a point.

    The practical consequence is the ordering. An operator who patches by score patches CVE-2026-12645 through CVE-2026-12647 first and gets to CVE-2026-12744 and CVE-2026-12745 fourth or fifth. That is the wrong order by any threat model you care to name. Pre-authentication remote code execution on an ITSM platform is the flaw that turns into an incident, because ITSM systems are where the credentials, the asset inventory and the change-approval workflow live, and because an unauthenticated attacker does not have to phish anyone first. The 9.9s need an account. The 9.8s do not.

    Then there is the version question. “Before 2026.2” is honest and it is nearly useless to an on-premises operator, because it does not say which patch closes the hole on the release they are actually running. Ivanti ships Neurons for ITSM as both a hosted service and an on-premises product, and it has a documented habit of fixing the hosted side first and quietly. In April 2026, reporting on an earlier pair of ITSM CVEs, SecurityWeek quoted Ivanti saying “No action is required for customers using the cloud solution as the fix was applied to all cloud environments on 12 December 2025” — four months before the CVEs were public. Trade coverage of today’s batch describes the same structure again: the cloud service fixed in August, on-premises releases waiting on September patches. Severity Daily could not confirm that from Ivanti directly, for the reason given below.

    If that structure holds, the CVE records are describing a fix that already happened for one population and has not happened for another, using one version number that belongs to neither. It is not a false record. It is a record that answers a different question than the one an administrator is asking.

    What to do

    • Patch the two unauthenticated flaws first — CVE-2026-12744 and CVE-2026-12745 — regardless of the fact that four other CVEs in the same advisory carry higher numbers. PR:N beats a tenth of a point.
    • On-premises operators: read the vendor advisory, not the CVE record, to find the patch for your release. The records name only 2026.2. Open hub.ivanti.com in a browser; it does not serve to automated clients.
    • Hosted customers: confirm the date your tenant was patched rather than assuming it tracks the CVE publication date. On this product the hosted fix has previously preceded disclosure by months.
    • Ivanti Sentry: upgrade to R10.8.2, R10.7.3 or R10.6.4 for CVE-2026-83527, an unauthenticated authentication bypass. EPMM: 12.10.0.0, 12.9.0.2 or 12.8.0.4 for CVE-2026-18851.
    • If your scanner reports these by CVSS alone, override the ordering by hand. This advisory is a case where the numbers and the risk disagree.

    Sourcing note

    Checked: the CVE Program CNA records at cveawg.mitre.org/api/cve/ for CVE-2026-12645, CVE-2026-12648, CVE-2026-12650, CVE-2026-12651 and CVE-2026-12744, retrieved individually; and NVD’s republication of all nine Ivanti records published September 8, 2026. The descriptions, CVSS vectors, scores, CWEs and affected blocks quoted above appear identically in both sources, which are independent retrievals of the same CNA submission.

    Could not reach: the Ivanti advisory itself. hub.ivanti.com and forums.ivanti.com both return HTTP 403 to automated fetching, and ivanti.com/blog/topics/security-advisory returned no listings. Three Ivanti hosts were tried. Everything attributed to the advisory in this story is therefore attributed to trade coverage instead, and labeled as such: the statement that Ivanti has no evidence of pre-disclosure exploitation, the August 2026 cloud patch date, the 2025.2 through 2026.1 on-premises range, the credit to AI-assisted internal discovery for the ITSM flaws and to btaol of Aquila Sec Lab for the Sentry flaw all come from CyberSecurityNews’s September 8, 2026 report, not from Ivanti. A reader with a browser should verify them at the source.

    Unresolved: what distinguishes CVE-2026-12650 from CVE-2026-12648 and CVE-2026-12651. The public record contains no difference between them other than the scope metric and the score it produces. Also unresolved: whether 2026.2 is the on-premises remedy for every affected release or only the current one. Nothing here should be read as a claim that any of these scores is wrong — only that the record does not show its work.

  • SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric

    SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric

    SAP’s September patch day put a 10.0 on a flaw its own record describes as a crash, and a 9.8 on one its own record describes as an attacker registering a rogue application server.

    What happened

    SAP released its September 2026 Security Patch Day on Tuesday, September 8. Seventeen CVE records carrying SAP’s CNA identifier, [email protected], entered the National Vulnerability Database in a single batch at 1:17 a.m. UTC that morning. Two of them sit in the SAP kernel, and the pair is worth reading side by side.

    The higher-scored of the two is CVE-2026-44756, covered by SAP Note 3747649. SAP’s description of it reads, in full: “A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination.” The assigned weakness is CWE-120, buffer copy without checking the size of input.

    SAP scored it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a base score of 10.0, the maximum the framework produces.

    The second is CVE-2026-58240, covered by SAP Note 3759472, in the NetWeaver Message Server. SAP’s description: “SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.” The weakness is CWE-308, use of single-factor authentication.

    SAP scored that one CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8.

    Every metric in the two vectors is identical except one. Attack vector, attack complexity, privileges required, user interaction, and all three impact metrics match. The only difference is scope: S:C on the Extended Passport flaw, S:U on the Message Server flaw. That single character is the entire 0.2 separating them. Strip the scope change from CVE-2026-44756 and it scores 9.8, the same as the other.

    The affected lists are release names, not patch levels. CVE-2026-44756 names KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 8.04, and WEBDISP 9.16, 9.18, 9.19, and 9.20. CVE-2026-58240 names KERNEL 9.16, 9.18, 9.19, and 9.20. Neither record carries a fixed version, a solution field, or a workaround. Each has exactly two references: the SAP note, and the generic patch day landing page at url.sap/sapsecuritypatchday. An unauthenticated fetch of me.sap.com/notes/3747649 returned no readable content — SAP notes require an S-user login, so the patch level that actually closes either flaw is not publicly stated anywhere.

    Both records were in NVD status “Received” as of Tuesday morning, meaning NVD had not analyzed them: no CPE data, no NVD-assigned score, and no CISA-ADP secondary score. SAP’s own numbers are the only numbers.

    Why it matters

    Scope is the CVSS v3.1 metric with the least agreement behind it. The specification defines a scope change as an impact that crosses a security authority boundary — the vulnerable component and the impacted component are not the same. In practice, different CNAs read that boundary differently, and there is no test that settles it. It is also the metric with the largest single effect on the final number, which is why it ends up carrying arguments that are really about something else.

    Here the argument is visible in the prose. SAP’s description of CVE-2026-44756 stops at “undefined behavior and abnormal program termination.” That is a crash. A crash supports A:H. It does not, on its own text, support C:H or I:H, let alone a scope change that lifts the total to a perfect 10.0. CWE-120 makes the full-compromise reading plausible — a buffer copy without a length check is the canonical path from crash to controlled write to code execution — but the record does not say that. It says the program terminates abnormally.

    Meanwhile the record that does describe a full compromise in plain words, where an unauthenticated attacker registers an unauthorized application server component and gets high confidentiality, integrity, and availability impact, is the one scored lower. Read the two descriptions with the scores hidden and most readers would rank them the other way around.

    This is not a pedantic complaint, because almost nothing downstream reads the prose. Vulnerability scanners ingest the vector. Ticketing systems sort on the base score. Patch windows are negotiated against a number, and a 10.0 wins that negotiation against a 9.8 every time, in every organization, without anyone opening the record. The team that patches by score patches the described crash first and the described takeover second.

    The Message Server flaw also has more history behind it than its score suggests. The message server is the component SAP application server instances register with to find each other; its internal port is meant to be reachable only from the application server subnet, and the access control list governing which hosts may register has been the subject of SAP guidance for years. CWE-308 — single-factor authentication — is the CNA saying the registration handshake proves less than it should. An attacker who can reach that port and register as an application server is inside the trust boundary of the system, not knocking on it.

    The second problem is the one Severity Daily keeps finding across vendors: the record tells you what is broken and refuses to tell you what fixes it. SAP kernels are versioned by release and patch level, and the patch level is the only thing that matters for remediation. The CVE record gives the release. The patch level lives in the note, and the note is behind a customer login. For an SAP customer with an S-user, this is a mild annoyance. For everyone else who has to reason about SAP exposure — an auditor, an acquirer running diligence, a managed service provider, a security team asked whether the vendor in its supply chain is patched — the public record stops one field short of useful.

    What to do

    Both fixes are kernel patches, not application patches, and both need an S-user to retrieve. Read SAP Note 3747649 for the Extended Passport flaw and SAP Note 3759472 for the Message Server flaw, and take the target patch level from the note rather than from any secondary summary.

    Prioritize by exposure, not by the two-tenths between the scores. For CVE-2026-44756, the affected list includes WEBDISP 9.16 through 9.20 — SAP Web Dispatcher is the reverse proxy many organizations place at the internet edge in front of an SAP landscape, which makes it the instance of this kernel most likely to be reachable by an unauthenticated attacker. Inventory Web Dispatcher separately from the ABAP and Java stacks; it is often patched on a different cadence and by a different team.

    For CVE-2026-58240, confirm which hosts can currently reach the message server’s internal port. As general practice rather than vendor instruction, that port should be reachable only from the application server subnet, and the registration ACL should be an explicit allowlist rather than a default. If reachability is broader than that today, narrowing it is worth doing while the kernel patch is being scheduled — it does not fix the validation weakness, but it shrinks the set of hosts that can attempt the registration.

    Do not treat the 10.0 as evidence of remote code execution when talking to leadership or to auditors. The honest statement is that SAP scored it 10.0, that SAP’s own description of the outcome stops at abnormal termination, that the weakness class is consistent with worse, and that no exploitation has been reported.

    Sourcing note

    Checked: the NVD API records for CVE-2026-44756 and CVE-2026-58240, and the authoritative CVE records from the CVE Program’s own API at cveawg.mitre.org for both, which agree on descriptions, vectors, CWEs, affected version lists, and the absence of any fixed version or solution field. Both records were published September 8, 2026 at 1:17 a.m. UTC, source [email protected], status “Received.”

    Could not reach: SAP’s own Security Patch Day page at support.sap.com, which is disallowed to automated fetching by its robots file, and SAP Note 3747649 at me.sap.com, which returned no readable content without a customer login. Secondary coverage of the patch day describes 19 notes in total; this page counts only the 17 SAP-CNA CVE records observed entering NVD in the September 8 batch, and does not assert a note total. Two CVEs named in secondary coverage, CVE-2026-58243 and CVE-2026-2332, were not present in that NVD window and are not described here.

    Unresolved: whether CVE-2026-44756 is exploitable beyond a denial of service. SAP’s description says termination; SAP’s vector says confidentiality, integrity, and availability with a scope change. The record does not reconcile the two, and SAP has published no exploitability statement in the public record. No exploitation of either flaw has been reported, and neither appears in CISA’s Known Exploited Vulnerabilities catalog as of this writing. NVD had not completed analysis of either record, so there is no independent score to compare against SAP’s.