Ivanti Neurons Patch CVE-2026-109412

Exploitation requires an authenticated session with the Ivanti Neurons Patch for Intune application (CVSS PR:L indicates a valid low-privilege account is needed - this is the primary limiting factor, as fully unauthenticated access is not indicated). Given a valid account, the attacker reaches a specific exposed, insufficiently protected endpoint/method (CWE-749) that returns sensitive authentication information; no user interaction (UI:N) and low attack complexity (AC:L) are required, and the vector is network-reachable (AV:N). The real-world impact depends on the value of the leaked authentication material and whether network access to the management interface is restricted; organizations that expose the console only to a trusted admin network materially reduce exposure.

The signals are partially conflicting and must be weighed carefully. The vendor-supplied CVSS of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) rates this Critical, driven by a network vector, low attack complexity, only low privileges required, no user interaction, and a changed scope with full CIA impact. However, the description characterizes the flaw strictly as an information-disclosure issue (CWE-749, exposed dangerous method/function) that 'leaks sensitive authentication information' - this does not independently justify the I:H/A:H integrity and availability impacts in the vendor vector; those appear inflated for a pure confidentiality leak, which deflates the real-world 9.9 somewhat. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no evidence of active or automatable exploitation at this time. The genuine risk driver is that the leaked data is authentication material: although exploitation requires an authenticated (PR:L) foothold, the disclosed credentials/tokens could enable privilege escalation or lateral movement to other systems (consistent with the S:C scope change), making this a credible chaining primitive rather than a standalone catastrophic break. Net assessment: a legitimately high-priority patch for organizations running this product because low-privilege users can harvest authentication secrets, but the headline 9.9 likely overstates direct impact - treat it as a high-value information-disclosure/credential-leak bug pending clarification of the integrity/availability claims with Ivanti.

A low-privileged but authenticated user of Ivanti Neurons Patch for Intune sends a request to an exposed, insufficiently protected endpoint and receives sensitive authentication information (such as service credentials or tokens) in the response. The attacker then reuses that material to access additional systems or escalate privileges. No public exploit code was identified at time of analysis, and the network vector with low complexity (AV:N/AC:L) means the request itself is trivial once the attacker has a valid low-privilege account.