CVE-2026-109412: Ivanti Neurons Patch for Intune Flaw Leaks Auth Data to Remote Attackers

Ivanti Neurons Patch for Intune contains a critical vulnerability that exposes sensitive authentication information to remote authenticated attackers. The National Vulnerability Database assigned CVE-2026-109412 a CVSS score of 9.9, marking it as a critical issue requiring immediate attention. This flaw arises from an exposed dangerous endpoint within the software product. Teams managing this specific integration need to assess their exposure immediately, as the weakness allows unauthorized access to critical authentication data if an attacker has valid credentials.

What is the scope of this vulnerability?

The issue is specific to Ivanti Neurons Patch for Intune. According to the NVD record, the weakness is classified under CWE-749, which relates to the exposure of sensitive information to an unauthorized actor. The vulnerability does not appear to affect other Ivanti products or general Intune deployments outside of this specific patch management integration. The scope is limited to systems running this particular software component.

How does the attack vector work?

An attacker must be remote and already authenticated to the system to exploit this flaw. The source material describes the mechanism as an exposed dangerous endpoint. This endpoint allows the attacker to leak sensitive authentication information. The vulnerability does not require unauthenticated access, meaning the threat actor must first possess valid login credentials. Once authenticated, they can interact with the endpoint to retrieve the sensitive data.

What is the severity rating?

The NVD rates CVE-2026-109412 as Critical with a CVSS score of 9.9. This score reflects the significant impact of leaking sensitive authentication information. The weakness is categorized under CWE-749. The rating indicates that the vulnerability poses a severe risk to the confidentiality of authentication data within the Ivanti Neurons Patch for Intune environment.

Is there a fix available yet?

No patch, fix, or update for CVE-2026-109412 has been confirmed in the source material. Organizations should monitor official channels for vendor guidance. Until a mitigation is released, teams should consider restricting access to the affected endpoint. Reviewing current authentication logs for unusual activity is also advisable. Do not assume the flaw is present in all configurations; verify the specific software version in use.

Detection notes

Teams usually start by reviewing web server logs for requests to the exposed endpoint. Look for authenticated sessions that trigger data retrieval patterns inconsistent with normal patch management operations. Check for unusual outbound data transfers from the management server. Investigate any authentication tokens that appear in unexpected contexts. Monitor for spikes in authentication traffic from single sources. These indicators can reveal early attempts to exploit the information leak. Containment often involves temporarily blocking access to the specific endpoint at the firewall level.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Ivanti

• Audit current access logs for the Ivanti Neurons Patch for Intune service to identify authenticated requests to the vulnerable endpoint.
• Restrict network access to the management console to trusted IP ranges to reduce the attack surface for remote authenticated users.
• Monitor for unusual authentication data transfers or large response payloads from the service that may indicate data leakage.
• Prepare to isolate the affected system if suspicious activity is confirmed, waiting for vendor guidance on a permanent fix.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The CVE ID is CVE-2026-109412.

Which product is affected by this flaw?

Ivanti Neurons Patch for Intune is the affected product.

What type of attacker is required to exploit this?

A remote authenticated attacker is required to exploit the vulnerability.