Critical Flaw in Ivanti Neurons Patch for Intune Exposes Authentication Data

Ivanti Neurons Patch for Intune contains a critical security vulnerability that allows remote attackers to leak sensitive authentication information. The flaw is tracked as CVE-2026-109412 and has been assigned a CVSS score of 9.9, marking it as a critical risk to organizations using the platform.

The vulnerability stems from an exposed dangerous endpoint within the Ivanti Neurons Patch for Intune software. According to the National Vulnerability Database record, this exposure enables a remote authenticated attacker to access sensitive authentication data. The weakness is classified under CWE-749, which relates to the use of exposed dangerous functions or methods.

Technical Details and Severity

The Common Vulnerabilities and Exposures identifier for this issue is CVE-2026-109412. The National Vulnerability Database lists the base severity as Critical, with a CVSS score of 9.9. This high score indicates that the flaw poses a significant risk to the confidentiality of authentication credentials.

The underlying weakness is categorized as CWE-749. This classification points to the use of an exposed dangerous function or method in the application code. In this specific case, the dangerous function is an endpoint that remains accessible to authenticated remote users. That suggests the application fails to properly restrict access to sensitive data transmission points.

Who Is Affected

The vulnerability specifically affects users of Ivanti Neurons Patch for Intune. This is a product within the Ivanti portfolio designed for patch management integration with Microsoft Intune. Any organization deploying this specific component is potentially exposed to the risk of credential leakage.

The attack vector is remote, meaning an attacker does not need physical access to the target system. However, the attacker must be authenticated to exploit the flaw. This requirement implies that an adversary must first obtain valid credentials or session tokens to access the vulnerable endpoint.

What should you do?

No patch or update has been confirmed for this vulnerability yet. Organizations using Ivanti Neurons Patch for Intune should monitor official channels for security advisories. Until a fix is released, administrators should review access logs for unusual activity related to authentication endpoints.