CVE-2026-109412

Executive Summary

CVE-2026-109412 is a critical (CVSS 9.9) exposure of a dangerous endpoint in Ivanti Neurons Patch for Intune that allows a remote authenticated attacker to leak sensitive authentication information. Because the flaw is scoped as a change (S:C) with high confidentiality, integrity, and availability impact, a successful exploitation of the exposed endpoint can compromise not only the vulnerable component but also the surrounding Intune and patch-management trust chain. No public proof-of-concept, Nuclei template, or exploit code is currently available, and no patch has been published, leaving exposed deployments without a vendor-supplied remedy.

Technical Analysis

The vulnerability maps to CWE-749: "Exposed Dangerous Method or Function." Per the NVD description, the affected software exposes a dangerous endpoint that, when reached by a remote authenticated attacker, leaks sensitive authentication information. Ivanti Neurons Patch for Intune is a patch-orchestration component that brokers authentication and job execution between Ivanti Neurons and Microsoft Intune; endpoints in such integrations commonly handle tokens, service-account credentials, or API secrets used to call downstream Intune APIs. The exposure of an endpoint that returns authentication material therefore creates a direct path to credential disclosure for any principal able to authenticate to the affected service.

Three characteristics of the description drive the risk profile. First, access is remote and requires only low privileges (PR:L), meaning a valid but unprivileged/lower-privileged account on the service is sufficient. Second, no user interaction is required (UI:N), so the leak can be triggered programmatically without tricking an administrator. Third, the scope is changed (S:C), indicating the leaked material enables impact beyond the vulnerable component itself — consistent with disclosure of credentials that grant access to a separate system (for example, the Intune tenant or an upstream Ivanti service).

Attack surface center on the network-reachable management/integration interface of Ivanti Neurons Patch for Intune. The dangerous endpoint is most plausibly reachable by authenticated users of that interface rather than by unauthenticated internet clients, though the exact URI, handler, or parameter names are not disclosed in the available data and must not be assumed. The precise code-level defect (for example, a missing authorization check, an over-permissive debug/diagnostic route, or a response that echoes credential material) cannot be confirmed from the description. What can be stated with confidence from the CNA/NVD text is the class: an authenticated-reachable endpoint returns sensitive authentication information to a caller that should not receive it.

No affected version range, no fixed version, and no vendor advisory have been published as of this report. The absence of version data means exposure must be assessed by presence of the product itself rather than by version fingerprinting.

Exploitation Scenarios

No public PoC or exploit code exists; the attack chain below is inferred from the vulnerability class (CWE-749 exposed dangerous method) and the stated conditions in the NVD description (remote, authenticated, no user interaction, scope change).

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed instance of Ivanti Neurons Patch for Intune. Discovery can be performed with standard HTTP fingerprinting of the application's login or management interface (see Shodan dorks above). The attacker determines the authentication scheme and obtains any low-privileged account or session, or leverages an already-compromised low-privileged account (PR:L).

2. Triggering the flaw class. Once authenticated, the attacker requests the dangerous endpoint that is exposed by the application. Because the defect is an exposed dangerous method/function, the service returns sensitive authentication information to the caller without adequate authorization gating or output restriction. No user interaction is needed, so the request can be issued directly and repeatedly.

3. Payload/execution method. At the vulnerability-class level, this is not a code-execution exploit; the "payload" is simply a crafted HTTP request to the exposed endpoint using a valid low-privileged session. The response — the leaked authentication material — is the objective. No specific URL path, parameter, or function name can be provided because none is disclosed in the source data.

4. Post-exploitation impact. The disclosed authentication information can be used to authenticate to systems that trust it. Given the changed scope (S:C), the leaked material plausibly enables access to the Intune tenant, the Ivanti Neurons platform, or related integration components. An attacker could then manipulate patch deployment jobs, exfiltrate managed-device inventory, or persist via the credentials. CVSS marks all three impact dimensions high, indicating credential misuse can degrade confidentiality, integrity, and availability of dependent systems.

Impact Assessment

The CVSS 3.1 base score is 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

• Attack Vector (N): exploitable over the network.
• Attack Complexity (L): no special conditions beyond a valid low-privileged session.
• Privileges Required (L): only low privileges needed.
• User Interaction (N): fully automatable by the attacker.
• Scope (C): impact crosses a trust boundary — leaked credentials affect components beyond the vulnerable product.
• Confidentiality (H): sensitive authentication information is disclosed.
• Integrity (H): leaked credentials enable modification of systems the credentials protect.
• Availability (H): credential misuse can disrupt patch management or the dependent Intune environment.

Business impact is severe for organizations using Ivanti Neurons Patch for Intune to orchestrate endpoint patching through Microsoft Intune. Compromise of authentication material in this trust path can let an attacker deploy or suppress patches across the managed fleet, tamper with device management, or maintain persistent access to the Microsoft cloud tenant. The blast radius is not limited to the Ivanti component because of the scope change; it extends to every system that trusts the leaked credentials — typically the entire managed endpoint population and the Intune administrative plane. No EPSS score is available, and the CVE is not listed in CISA KEV, so there is no confirmed exploit-in-the-wild evidence at this time; however, the high CVSS and credential-leak nature make it a high-value target if a PoC emerges.

Detection Guidance

Because the exact endpoint path is not disclosed, detections below focus on anomalous authenticated access to the Patch for Intune service, credential-material patterns in responses, and unusual authentication events against downstream Intune/Ivanti APIs.

Sigma Rule

title: Ivanti Neurons Patch for Intune - Exposed Endpoint Authentication Information Leak
id: 8f1c2a44-9d3b-4f6e-b7a1-2c9e5d7f1094
status: experimental
description: Detects anomalous authenticated access to the Ivanti Neurons Patch for Intune interface consistent with exploitation of an exposed dangerous endpoint (CWE-749) leaking authentication information.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109412
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: iis
detection:
  selection_host:
    cs-host|contains:
      - 'neurons'
      - 'patch-for-intune'
  selection_status:
    sc-status:
      - 200
      - 500
  selection_uri:
    cs-uri-stem|contains:
      - '/api/'
      - '/admin/'
      - '/config'
      - '/token'
      - '/auth'
  filter_normal:
    cs-method: 'GET'
    cs-uri-stem|endswith: '.aspx'
  condition: selection_host and selection_status and selection_uri and not filter_normal
falsepositives:
  - Legitimate administrative API calls
level: high
tags:
  - attack.t1190
  - cve.2026-109412

YARA Rule

rule CVE_2026_109412_Ivanti_Patch_Intune_CredLeak
{
    meta:
        description = "Detects authentication material or exposed dangerous endpoint indicators in Ivanti Neurons Patch for Intune responses/logs related to CVE-2026-109412"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109412"
        cve = "CVE-2026-109412"

    strings:
        $app1 = "Patch for Intune" ascii nocase
        $app2 = "Neurons" ascii nocase
        $ep1  = "authentication" ascii nocase
        $ep2  = "client_secret" ascii nocase
        $ep3  = "access_token" ascii nocase
        $ep4  = "refresh_token" ascii nocase
        $ep5  = "Authorization: Bearer" ascii nocase
        $ep6  = "tenant_id" ascii nocase

    condition:
        ($app1 or $app2) and 2 of ($ep*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109412 Ivanti Neurons Patch for Intune - Exposed Endpoint Authentication Information Leak Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; http.uri; content:"token"; http.header; content:"Authorization"; reference:cve,2026-109412; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109412; classtype:attempted-recon; sid:2026109412; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where http.request.method == "GET" and
      url.path : ("*token*" or "*auth*" or "*config*" or "*credentials*") and
      http.response.status_code == 200 ]
  [ network where http.response.body : ("*access_token*" or "*client_secret*" or "*refresh_token*" or "*tenant_id*") ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_common OR sourcetype=iis
(http_uri_path="*token*" OR http_uri_path="*auth*" OR http_uri_path="*config*" OR http_uri_path="*credentials*")
(status=200 OR status=500)
(host="*neurons*" OR host="*intune*" OR uri="*neurons*")
| stats count min(_time) as first_seen max(_time) as last_seen values(http_uri_path) as paths by src_ip, user, host
| where count > 5
| sort -count

Wazuh OSSEC Rule

<group name="ivanti,web,cve-2026-109412,">
  <rule id="100412" level="12">
    <if_sid>31100</if_sid>
    <field name="url">/token|/auth|/config|/credentials</field>
    <regex>access_token|client_secret|refresh_token|tenant_id</regex>
    <description>CVE-2026-109412: Possible authentication information leak via exposed Ivanti Neurons Patch for Intune endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109412,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Since no vendor fix exists, restrict network access to Ivanti Neurons Patch for Intune to trusted management networks only; do not expose the interface to the internet. Enforce least privilege on all accounts that can reach the interface, and rotate any credentials, tokens, or secrets that the product uses to communicate with Microsoft Intune or Ivanti Neurons, on the assumption they may have leaked. Monitor for and alert on access to unknown or unprotected endpoints on the service.

2. Patch/upgrade steps. No fixed version has been published. Track the Ivanti security advisories page and the NVD entry for CVE-2026-109412 and apply the vendor patch immediately upon release. Until then, maintain compensating network controls.

3. Long-term hardening. Enforce strong authentication (MFA) and short-lived, scoped credentials for integration accounts. Segment patch-management infrastructure from general corporate networks and the public internet. Apply outbound restrictions so leaked credentials have limited reach. Audit periodically for exposed dangerous methods/functions (CWE-749) in integration components and require vendor disclosure of endpoint inventories.

References

• NVD — CVE-2026-109412: https://nvd.nist.gov/vuln/detail/CVE-2026-109412
• CWE-749: Exposed Dangerous Method or Function — https://cwe.mitre.org/data/definitions/749.html
• Ivanti Security Advisories — https://www.ivanti.com/security
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-109412 not listed at time of writing)
• FIRST EPSS — https://www.first.org/epss/ (no score available at time of writing)

No threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-109412 as of this report. No public PoC, Nuclei template, or exploit code is available.