Ivanti Fixes Critical Security Holes in Three Business Software Products
Six flaws in Ivanti Neurons for ITSM could let attackers run malicious code on affected systems from anywhere on the internet. Two other products, Sentry and EPMM, received fixes for authentication bypass bugs.
Key points
- Ivanti patched six critical-rated vulnerabilities in its Neurons for ITSM product, all of which could allow remote code execution.
- Ivanti Sentry and EPMM received patches for authentication bypass flaws, letting attackers skip the login step entirely.
- Remote code execution flaws are among the most serious type: attackers can run their own software on a victim's systems without needing physical access.
- Organisations running affected versions must apply updates manually; no patch deploys itself.
Ivanti, a company that sells software used by IT departments to manage devices and handle internal support tickets, has released security updates for three of its products after researchers found serious vulnerabilities.
What did the attackers find?
The most serious problems sit inside Ivanti Neurons for ITSM, a help-desk and IT service management platform. Six separate vulnerabilities carry a "critical" severity rating. Each could allow remote code execution: an attacker anywhere on the internet could send specially crafted requests and cause the software to run malicious code of their choosing, no password or building-access required. That's a worst-case outcome for any software flaw.
Ivanti Sentry and Ivanti EPMM (Enterprise Point-of-Need Mobility Management, the software companies use to manage staff smartphones and laptops) both received patches for authentication bypass vulnerabilities, which let an attacker reach restricted parts of a system without valid credentials.
This is the fourth Ivanti story we've reported in the last 90 days. When attackers exploited a critical flaw in JFrog Artifactory within 72 hours of disclosure, the pattern was identical: a high-severity patch, a narrow window, and organisations caught mid-update cycle. Ivanti's track record of being actively targeted makes that window worth taking seriously.
Should the people who use these products be worried?
If your employer uses any of these three products without yet applying the patches, yes. The risk is real.
Ivanti's advisory pages list the exact version numbers that are safe; IT teams should compare those against whatever is currently running. Affected customers should consult Ivanti's security advisory portal for the authoritative version list.
What should ordinary employees do?
Most staff won't touch these systems directly. IT administrators are the ones who need to act fast. If you work somewhere that uses Ivanti products, flag this to your IT or security team and ask whether the patches are in.
Common questions
Is my personal data at risk?
Potentially, if your employer uses the affected software and hasn't patched it. Help-desk platforms often hold staff names, contact details, and device records. A successful attack could expose all of it.
How long do companies usually have before attackers start exploiting flaws like this?
Not long. Attackers begin probing newly disclosed vulnerabilities within days of a public announcement, and Ivanti's products have drawn active exploitation before. Prompt patching isn't optional here; it's the only lever available.
