IVANTI released two security advisories on 13 October 2026 detailing six vulnerabilities across Neurons Patch for Intune and Ivanti Xtraction, with two rated CVSS 9.9. The disclosures emphasise credential theft risk, noting that stolen secrets could grant access beyond the compromised app itself. Ivanti reports no known exploitation at the time of disclosure.
In Ivanti Xtraction, the most serious flaw is CVE-2026-106042 (CVSS 9.9), which authenticated attackers can exploit to redirect application requests to their own server and obtain EPMM connector credentials transmitted by the application.
Four additional Xtraction flaws include CVE-2026-106047 (CVSS 7.7) a path traversal that allows reading arbitrary files; CVE-2026-106043 (CVSS 7.5) a missing authentication bug enabling unauthenticated attackers to create or modify a trusted site; and CVE-2026-106034 and CVE-2026-106035, both medium-severity issues involving directory changes and SQL password leaks in logs.
For Neurons Patch for Intune, CVE-2026-109412 describes a cloud-service endpoint exposure that enables a remote authenticated attacker to leak sensitive authentication information.
Affected versions include Neurons Patch for Intune (cloud service, fixed for all environments on 16 September 2026) and Ivanti Xtraction (versions up to 2026.2.1). Mitigations call for updating Xtraction to 2026.4, rotating the Entra ID client secret used for Intune publication, and rotating EPMM connector credentials. Ivanti notes Intune customers require no update, though they advise secret rotation as a precaution given the focus on credentials.