Ivanti Neurons Patch for Intune Gets Critical 9.9 CVSS Rating for Auth Data Leak

Ivanti Neurons Patch for Intune contains a critical security flaw that exposes sensitive authentication data to remote attackers who possess valid login credentials. The National Vulnerability Database records this issue as CVE-2026-109412 and assigns it a maximum severity score of 9.9. This high-risk vulnerability stems from an exposed dangerous endpoint within the application that fails to properly restrict access to sensitive information.

In plain English

The vulnerability allows anyone with an account to retrieve private authentication details. The system exposes an endpoint that should remain protected, making sensitive data accessible to remote users. Attackers do not need to bypass initial login walls, but they must have a valid user account. Once logged in, they can reach the endpoint and leak the authentication information.

The background

The National Vulnerability Database identifies the specific weakness as CWE-749. This classification points to improper handling of information that leads to exposure. The affected product is specifically Ivanti Neurons Patch for Intune. The record notes that the flaw allows a remote authenticated attacker to leak sensitive authentication information. No other software versions or related products are mentioned in the current advisory.

What changes now

Security teams must treat any active use of Ivanti Neurons Patch for Intune as a potential risk until further notice. The presence of an exposed endpoint means that internal accounts are not safe from data leakage. Organizations should assume that any authenticated session could potentially access sensitive authentication details. Immediate review of access logs and endpoint configurations is warranted for all affected environments.

What made it possible

Exposing sensitive data through accessible endpoints is a common architectural mistake. Teams usually map all public and internal API routes to identify unintended disclosures. Check whether authentication checks apply to every data retrieval function, not just entry points. Ensure that sensitive tokens and credentials are never served via standard HTTP responses. Regularly audit endpoint permissions to verify that only authorized roles can access critical system information.

Background: Data leaks

A data leak occurs when sensitive information leaves its intended boundary through unauthorized channels. These events often result from misconfigured cloud storage, insider negligence, or compromised credentials. Reducing risk requires strict access controls, continuous monitoring of data movement, and automated classification of sensitive assets to prevent accidental exposure.

Read the full guide: Data Leaks Explained: Mechanisms, Risks, and Prevention Strategies

What to do and how to stay safe: Ivanti

• Audit all active user accounts in Ivanti Neurons Patch for Intune to identify potential abuse.
• Review network logs for unusual access patterns to internal endpoints from authenticated sources.
• Restrict network access to the application to only trusted internal subnets where possible.
• Monitor for any unauthorized data exfiltration attempts originating from the affected service.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity rating for CVE-2026-109412?

The National Vulnerability Database rates CVE-2026-109412 as Critical with a CVSS score of 9.9.

Do attackers need to be logged in to exploit this flaw?

Yes, the vulnerability requires a remote authenticated attacker to leak sensitive authentication information.

Which software is affected by this vulnerability?

Ivanti Neurons Patch for Intune is the affected product identified in the advisory.