Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Ivanti

  • Two 10.0s drew a Friday federal deadline, and in half of today’s stories the vendor contradicts its own record

    Two 10.0s drew a Friday federal deadline, and in half of today’s stories the vendor contradicts its own record

    The most important thing today is a date: Friday, September 11, 2026. CISA added two flaws scoring 10.0 to the Known Exploited Vulnerabilities catalog on September 8 and put the same three-day due date on both. Adobe Commerce is exploited in the wild by Adobe’s own statement, needs no authentication, and affects every supported branch of Commerce, B2B, and Magento Open Source. N-able N-central is pre-authentication remote code execution in the platform managed service providers point at their clients’ networks.

    The biggest-sounding story of the day is neither of them. Veradigm told the SEC that an attacker took credentials from a third-party vendor, used them against a Veradigm API, and downloaded patient data including Social Security numbers. For the people in that file it is the worst thing on the page. For anyone deciding what to do before Friday it is inert: the filing names no vendor, no date, and no count. The two KEV entries come with a deadline inside the week and something to install. That is why they lead.

    The thread

    Six of today’s twelve stories — exactly half — are a vendor’s own record disagreeing with itself. N-able’s status page says there are no confirmations of exploitation while its blog says the opposite, on the CVE CISA has now listed as exploited. Microsoft marks both of today’s Windows zero-days exploited, then ships a temporal vector on one of them reading E:U, exploit code unproven. SAP scores a flaw its record describes as a crash at 10.0 and one describing a rogue application server at 9.8, and the entire gap is one scope metric. Siemens splits one broken session token in the Reyrolle 7SR5 into three CVEs, and its own v3.1 and v4.0 vectors disagree on how hard one of them is to attack. Ivanti published three ITSM records with byte-identical descriptions and the same weakness class, two scored 8.8 and the third 9.9. Adobe stamps its ColdFusion bulletin Priority 1 and says in the same document that it is aware of no exploits.

    The score, the severity label, and the exploitation status are produced by different processes inside the same organization, and today six of them shipped out of step. The consequence is the same every time: the number you sort your queue on is not the number that tells you what to do.

    The rest, in the order it deserves attention

    Behind Friday, the same Microsoft release carries two Windows local privilege escalations at 7.8 with a September 22 federal deadline. The ColdFusion bulletin covers nine CVEs across both shipping releases. Ivanti Neurons for ITSM shipped eight CVEs, two of them unauthenticated deserialization at 9.8. Snowflake’s drivers attached a cloud workload-identity token to the login request before checking the host was Snowflake, across eight driver lines. Siemens Siveillance Control fixes a root-level file upload in which each of four editions has a different build number meaning “fixed.” On the filings side, Boston Scientific escalated to Item 1.05 and named the 2026 guidance it will miss, and United Natural Foods booked its June 2025 attack as a $21 million credit, because $45 million of insurance arrived a fiscal year after the costs it covers.

    Still open

    Adobe’s remediation for the Commerce 10.0 is a composer patch, and the bulletin’s solution column still carries no version number: agencies have until Friday to apply something they cannot cite by version. N-able has not reconciled its two live statements, and NVD’s affected list includes Hotfix 3, the build N-able told on-premises customers on September 5 to install immediately. Fourteen days after the attack, Boston Scientific still has not said whether anything was taken. Veradigm has not named the vendor whose credentials were stolen, or how many people are in the file.

    Sourcing note: this page adds no facts to the stories it links; each carries its own primary source. The September 11 and September 22 deadlines were re-confirmed tonight against NVD, which republishes CISA’s cisaExploitAdd and cisaActionDue verbatim. NVD was inconsistent while that was done: within one hour the same API returned a stale copy of CVE-2026-75650 with no CISA fields and then the current record at lastModified 2026-09-08T19:29:17.803 carrying them, and returned totalResults of 0 for both Windows CVE IDs on two query forms before returning the full records on a third. All four deadlines are confirmed. The lesson for anyone checking these dates themselves is that a single empty NVD response is not evidence of anything — query again before concluding a record is missing. cisa.gov blocks automated fetching directly.

    Correction, September 8, 2026: an earlier version of this sourcing note, live for roughly three minutes after publication, said NVD “returned no record at all for either Windows CVE at the time of writing.” That described two failed queries, not the state of the catalog. Both records were retrieved in full on a retry and carry a cisaActionDue of 2026-09-22. The note above has been rewritten.

  • Three Ivanti ITSM records share one description and one CWE, and two score 8.8 while the third scores 9.9

    Three Ivanti ITSM records share one description and one CWE, and two score 8.8 while the third scores 9.9

    Ivanti published eight Neurons for ITSM CVEs on September 8, 2026; three of them carry byte-identical descriptions and the same weakness class, two are scored 8.8 and the third 9.9, and the two flaws that need no login at all score below four that do.

    What happened

    Between 2:20 p.m. and 2:38 p.m. UTC on Tuesday, September 8, 2026, Ivanti published eight CVE records for Ivanti Neurons for ITSM, its IT service management platform. All eight reached NVD at 3:18 p.m. UTC. All eight cite a single reference: an advisory at hub.ivanti.com titled “Security Advisory Ivanti Neurons for ITSM Multiple CVEs.”

    Here is the set, as the records themselves state it:

    • CVE-2026-12744 and CVE-2026-12745 — CWE-502, deserialization of untrusted data. “A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.” CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
    • CVE-2026-12645, CVE-2026-12646, CVE-2026-12647 — CWE-862, missing authorization. “A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.” CVSS 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
    • CVE-2026-12650 — CWE-502. “A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.” CVSS 9.9, vector ...PR:L/UI:N/S:C/....
    • CVE-2026-12648 and CVE-2026-12651 — CWE-502. Description: identical, word for word, to CVE-2026-12650’s. CVSS 8.8, vector ...PR:L/UI:N/S:U/....

    Read that last pair against the one above it. Three records, published within ten minutes of each other by the same CNA, for the same product, in the same weakness class, whose English descriptions do not differ by a single character. Two are scored 8.8. One is scored 9.9. The entire 1.1-point gap is the scope metric: S:U on two, S:C on the third.

    The same metric produces the second oddity. The only two flaws in the set that require no authentication — the ones an anonymous attacker on the network can reach — are scored 9.8. Four flaws that require the attacker to hold credentials are scored 9.9. On paper, in a triage queue sorted by number, Ivanti’s pre-authentication remote code execution ranks below its post-authentication remote code execution.

    Every one of the eight records describes its affected versions the same way: a single version entry, 2026.2, marked unaffected, with defaultStatus: affected. No lower bound, no enumeration of shipping releases. The prose says “before 2026.2” and the structured data says the same thing in the widest possible way — everything that is not 2026.2.

    Ivanti published two further records the same day for other products: CVE-2026-18851, missing authorization in Endpoint Manager Mobile allowing an authenticated attacker to escalate to admin, 8.8, fixed in 12.10.0.0, 12.9.0.2 and 12.8.0.4; and CVE-2026-83527, an authentication bypass in Ivanti Sentry reachable by a remote unauthenticated attacker, 8.1, fixed in R10.8.2, R10.7.3 and R10.6.4. Both of those records name specific fixed builds. The ITSM records do not.

    Why it matters

    The scope metric is the single most contested field in CVSS v3.1, and this is what the argument looks like in production. S:C means the vulnerable component and the impacted component are different — the attacker breaks out of the security authority that was supposed to contain them. Ivanti has decided that four of these flaws do that and that the two unauthenticated ones do not, and it has decided that one deserialization bug does while two deserialization bugs described in exactly the same words do not.

    That may be entirely correct. Scope is a property of the code path, not of the sentence describing it, and three bugs can share a CWE, a product and a sentence while differing in whether the deserialized object escapes into a different security context. The problem is that the record gives a reader no way to tell. The description is the only substantive field in these records, and on three of them it is the same string. Whatever distinguishes CVE-2026-12650 from CVE-2026-12648 exists somewhere in Ivanti’s internal analysis and nowhere in the public record.

    This site has now seen the scope metric drive a ranking inversion twice in one day. This morning it was SAP, where a described crash scored 10.0 and a described takeover scored 9.8 on the strength of the same field. The pattern is not a vendor problem so much as a metric problem: scope is the one CVSS base metric that requires a judgment call about architecture rather than an observation about the attack, and it moves scores by more than a point.

    The practical consequence is the ordering. An operator who patches by score patches CVE-2026-12645 through CVE-2026-12647 first and gets to CVE-2026-12744 and CVE-2026-12745 fourth or fifth. That is the wrong order by any threat model you care to name. Pre-authentication remote code execution on an ITSM platform is the flaw that turns into an incident, because ITSM systems are where the credentials, the asset inventory and the change-approval workflow live, and because an unauthenticated attacker does not have to phish anyone first. The 9.9s need an account. The 9.8s do not.

    Then there is the version question. “Before 2026.2” is honest and it is nearly useless to an on-premises operator, because it does not say which patch closes the hole on the release they are actually running. Ivanti ships Neurons for ITSM as both a hosted service and an on-premises product, and it has a documented habit of fixing the hosted side first and quietly. In April 2026, reporting on an earlier pair of ITSM CVEs, SecurityWeek quoted Ivanti saying “No action is required for customers using the cloud solution as the fix was applied to all cloud environments on 12 December 2025” — four months before the CVEs were public. Trade coverage of today’s batch describes the same structure again: the cloud service fixed in August, on-premises releases waiting on September patches. Severity Daily could not confirm that from Ivanti directly, for the reason given below.

    If that structure holds, the CVE records are describing a fix that already happened for one population and has not happened for another, using one version number that belongs to neither. It is not a false record. It is a record that answers a different question than the one an administrator is asking.

    What to do

    • Patch the two unauthenticated flaws first — CVE-2026-12744 and CVE-2026-12745 — regardless of the fact that four other CVEs in the same advisory carry higher numbers. PR:N beats a tenth of a point.
    • On-premises operators: read the vendor advisory, not the CVE record, to find the patch for your release. The records name only 2026.2. Open hub.ivanti.com in a browser; it does not serve to automated clients.
    • Hosted customers: confirm the date your tenant was patched rather than assuming it tracks the CVE publication date. On this product the hosted fix has previously preceded disclosure by months.
    • Ivanti Sentry: upgrade to R10.8.2, R10.7.3 or R10.6.4 for CVE-2026-83527, an unauthenticated authentication bypass. EPMM: 12.10.0.0, 12.9.0.2 or 12.8.0.4 for CVE-2026-18851.
    • If your scanner reports these by CVSS alone, override the ordering by hand. This advisory is a case where the numbers and the risk disagree.

    Sourcing note

    Checked: the CVE Program CNA records at cveawg.mitre.org/api/cve/ for CVE-2026-12645, CVE-2026-12648, CVE-2026-12650, CVE-2026-12651 and CVE-2026-12744, retrieved individually; and NVD’s republication of all nine Ivanti records published September 8, 2026. The descriptions, CVSS vectors, scores, CWEs and affected blocks quoted above appear identically in both sources, which are independent retrievals of the same CNA submission.

    Could not reach: the Ivanti advisory itself. hub.ivanti.com and forums.ivanti.com both return HTTP 403 to automated fetching, and ivanti.com/blog/topics/security-advisory returned no listings. Three Ivanti hosts were tried. Everything attributed to the advisory in this story is therefore attributed to trade coverage instead, and labeled as such: the statement that Ivanti has no evidence of pre-disclosure exploitation, the August 2026 cloud patch date, the 2025.2 through 2026.1 on-premises range, the credit to AI-assisted internal discovery for the ITSM flaws and to btaol of Aquila Sec Lab for the Sentry flaw all come from CyberSecurityNews’s September 8, 2026 report, not from Ivanti. A reader with a browser should verify them at the source.

    Unresolved: what distinguishes CVE-2026-12650 from CVE-2026-12648 and CVE-2026-12651. The public record contains no difference between them other than the scope metric and the score it produces. Also unresolved: whether 2026.2 is the on-premises remedy for every affected release or only the current one. Nothing here should be read as a claim that any of these scores is wrong — only that the record does not show its work.