CVE-2026-109412

CriticalCVSS 9.9/10Last modified Oct 14, 2026

Description

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-749

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1094138.7In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() aCVE-2026-1094146.5The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / srCVE-2026-1094155.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-109427.8Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalatiCVE-2026-1094228.1NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in CVE-2026-1094237.4NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerabilitCVE-2026-1094245.9NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eaCVE-2026-1094255.3Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSCVE-2026-1094267.5Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backupsCVE-2026-1094276.5Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access CVE-2026-1094288.8Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by eCVE-2026-1094298.8Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hi
CVE-2026-109412: Critical severity, CVSS 9.9 | Vulnix